c2bab6182d1dbc80b1b1fed53d3952c14d1249cd093496e21aa1a5c51683dfa3 | Triage

Sharing

General

Target

c2bab6182d1dbc80b1b1fed53d3952c14d1249cd093496e21aa1a5c51683dfa3
Size

124KB
Sample

221124-ewzvaabh5w
MD5

48ae2d618339b5fe727558870eab4f4a
SHA1

915b91a9e6debf909e555ed0b4ba311aadc6ec22
SHA256

c2bab6182d1dbc80b1b1fed53d3952c14d1249cd093496e21aa1a5c51683dfa3
SHA512

cd4973f1ff999cd992a859db17be0c45b38d6e92804a674e1a8ec4ef0cd898838da992dacbf26d9728d070b0ab7733e32b5eff7cc34bc80c87da744cb97c6f7b
SSDEEP

3072:TKYibOc7OECeWVKXdevcaFFAn+jUkrKkO2WU2wmO:+YitaxeSKXgcaZBx3ft

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
- Size
  
  164KB
- MD5
  
  744c74d17d06d1a57fde4eb674b658e5
- SHA1
  
  4db6ca64d8891bea93e4fef0e54753afefe2fc1f
- SHA256
  
  2c4ebda5b2fc4e138ac11f456cafc4fbdf81f557c1d27469da123a8a4bad7da4
- SHA512
  
  ca43f4e7d33d1192facb320d27dfda3519b5fe8c723baa79e9e71b87a677ea75577fb8bb3ae45365207c736ec1f7273ceed12de5725ff20005f172e77538decd
- SSDEEP
  
  3072:aLYWOECeWVKXdevckFFAn+jUkrKkO2oATT5o/2OWo:aLwxeSKXgckZBx3o4TWq
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2