fc478c3c64417e5a727df45e029977badb0d7105dadd05cbbe2a37a207581146 | Triage

Sharing

General

Target

fc478c3c64417e5a727df45e029977badb0d7105dadd05cbbe2a37a207581146
Size

126KB
Sample

221124-eyayyaca3z
MD5

b234d3fd7ada06cd7736c4b9e69b91d2
SHA1

3533a1375044ce767dd313935ff4b50059fe6c41
SHA256

fc478c3c64417e5a727df45e029977badb0d7105dadd05cbbe2a37a207581146
SHA512

f2d46a8c53a4faa5736f4b1b81192da12a4781c071c9afea5f2cd13b681e7069b122f098c037d53ef3a2e95bc7b39f8c84a651d0919a31892a40c3d455047868
SSDEEP

3072:o3FJ821ZZR7TwOCMiECI115hswWey5ZU6GEAE+YBqid4l:oVJ8GZR7TwOCMiECI3pT2jhC/b

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
- Size
  
  168KB
- MD5
  
  bbf602cc98f05af58228dfc975622b04
- SHA1
  
  70fb72c5217aed3c52349a3a92fda087297203b5
- SHA256
  
  64dbe523c9ff1558fedaba3d2fc6476893cb2286703e69bcb30eb3015f5bd82a
- SHA512
  
  bc1e3819532e0cbcc7377c5e64cb100ef211a9e6b502f0d36a14ec0b80d2378e28d3263d64071448901a8096e904a7e845124a5d7ecc2c670459f1d6e783cfcd
- SSDEEP
  
  3072:lfmAD4c6xEGUAV31hECI115hswWe25ZU6GEAE+YBTVdX7lqEd+zr3/1C:lfYc6EGUYhECI3pTqjhC0fUlM
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2