Overview

overview

7

Static

static

Informatio...05.exe

windows7-x64

7

Informatio...05.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e671cbd9637cadf07c920de685881b6e7acf8cff9a627c4589373f8e2ebdee0a

  • Size

    120KB

  • Sample

    221124-ek7ezsba7x

  • MD5

    124287b2b16412cd13f29087d74d22f5

  • SHA1

    1b45b71df300d90fc1357e5897d5fe1f20a3b045

  • SHA256

    e671cbd9637cadf07c920de685881b6e7acf8cff9a627c4589373f8e2ebdee0a

  • SHA512

    4be17d8e1ae759cc9de9e683b3222bba5c18378f85af09057f9d3975a954a463dab5fa8b2be0601d0dcc46a551ea087962a1a6b84799c10e5ec81834218a22f2

  • SSDEEP

    3072:ZcJI0yFktepDlXFQuYlgSLLPr6s6THp6YF/xUhlz8k2ck5T:ZoisaQuYumqJ6Hhx8tck

Score
7/10
persistence

Malware Config

Targets

    • Target

      Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe

    • Size

      148KB

    • MD5

      bb6eaa3caf122030e276ddb20790e5e5

    • SHA1

      050019c2864790aa5f0ac4fa6d2e1a65eb59cd70

    • SHA256

      bba5332c6f0d44bc3f2935842dfbcc051f3edb1b7f186a94c665271ccca13755

    • SHA512

      1290ae818f8a64288848fd6fc1e721edb96b4cd5b0991b1f7d10602198ddefdfcdd1f8b3b7610594432581752f14cc60514cd57930c636a4b8a714a18f7d4d7d

    • SSDEEP

      3072:cIjIB3k5uMfRUL9glXFQuMlgSLLPr6s6THgFWP27:n/uUa+QuMumqAFWP6

    Score
    7/10
    persistence

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks