Overview

overview

7

Static

static

rechnung_n...89.exe

windows7-x64

7

rechnung_n...89.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e7ba6265507e43544da9bd9df3f464a4393ea07cc9fb398d80d5becec3ecfdeb

  • Size

    124KB

  • Sample

    221124-ewx1pagf77

  • MD5

    c382597922e9df0f2d91a074e75cd534

  • SHA1

    97fd16fdc4046ebc1e76a901403041043f217b61

  • SHA256

    e7ba6265507e43544da9bd9df3f464a4393ea07cc9fb398d80d5becec3ecfdeb

  • SHA512

    0ae4b00fc2f1bcfab8083dfa1d0e0d30f80e2ac64903e985c2217385d956e8717dd62d2c3128675baeef3c9c539e5208133b0f9fb9d56e4a0480716f2bf920c5

  • SSDEEP

    3072:vvKYibOc7OECeWVKXdevcaFFAn+jUkrKkO2WU2wmlg:vSYitaxeSKXgcaZBx3fqg

Score
7/10
persistence

Malware Config

Targets

    • Target

      rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

    • Size

      164KB

    • MD5

      744c74d17d06d1a57fde4eb674b658e5

    • SHA1

      4db6ca64d8891bea93e4fef0e54753afefe2fc1f

    • SHA256

      2c4ebda5b2fc4e138ac11f456cafc4fbdf81f557c1d27469da123a8a4bad7da4

    • SHA512

      ca43f4e7d33d1192facb320d27dfda3519b5fe8c723baa79e9e71b87a677ea75577fb8bb3ae45365207c736ec1f7273ceed12de5725ff20005f172e77538decd

    • SSDEEP

      3072:aLYWOECeWVKXdevckFFAn+jUkrKkO2oATT5o/2OWo:aLwxeSKXgckZBx3o4TWq

    Score
    7/10
    persistence

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks