Overview

overview

7

Static

static

2014_11_re...08.exe

windows7-x64

7

2014_11_re...08.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    861f171c6ccf9b39b1138484f23b43f6b59163e890171aa423896b7d3593feca

  • Size

    126KB

  • Sample

    221124-ey1jlaca7x

  • MD5

    52d531ac6c81097319b075bd16cb36ba

  • SHA1

    4c3e83358ada2a0784303709ddd49cf4f5c08c6b

  • SHA256

    861f171c6ccf9b39b1138484f23b43f6b59163e890171aa423896b7d3593feca

  • SHA512

    222263400052687c2f57a893ce9d4c48a46d421ce6b43d86c4c26ad09f1364d1b4982c0391c955c8da4e65b2470a48f55bae5ca75acf3854600a263477b56bdc

  • SSDEEP

    3072:vRUGgqRxKNnpXtAVR6Li2ikZSYbmlpSchjDeb0Mcnnx:5UG7ANn9Oy7ZS9h2Yxnx

Score
7/10
persistence

Malware Config

Targets

    • Target

      2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

    • Size

      168KB

    • MD5

      91291b0c1fb27cff77c5a7731807abf0

    • SHA1

      0cdd5dcdf23c65136faf067d55a098f1fb93469f

    • SHA256

      ede3136fd45a022bb470ff9a2752d4b48c641e1fe6ddc4aa5fa3a414b6921b95

    • SHA512

      65632a66c7cb3fdbdf0e89de5298b378597e96e8a1a96f232669dd7a70235b428b45f529f6175555ea67ad987dbdfade0697b3ee440bfebf9a473db3279b490a

    • SSDEEP

      3072:pVmADg66x5y7FuW3jLi2ikZSYbmlpSchjDeL8lOW+9d+zr3/1C:pVA665pW3Z7ZS9h2LjOM

    Score
    7/10
    persistence

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks