Overview

overview

7

Static

static

2014_11_re...08.exe

windows7-x64

7

2014_11_re...08.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3ac432c6c347912aa989db78a31a2ab58c59f6730dd7c148f304bfd959ef8fb3

  • Size

    126KB

  • Sample

    221124-eymbzaca5x

  • MD5

    ff252be48746095e3c3e13827c5870ba

  • SHA1

    13e8683443caf84f767cc4c56b458f9cd52aef0e

  • SHA256

    3ac432c6c347912aa989db78a31a2ab58c59f6730dd7c148f304bfd959ef8fb3

  • SHA512

    f7af6e4e4184ca6eb067756938154e9ff0a61bf366ba3e523e5b4299f4f7732178a6bad187ae8d4107c9037000dbbb2000ae8f6253ed5a6989ee4befc573a6ac

  • SSDEEP

    3072:a3FJ821ZZR7TwOCMiECI115hswWey5ZU6GEAE+YBqid47:aVJ8GZR7TwOCMiECI3pT2jhC/9

Score
7/10
persistence

Malware Config

Targets

    • Target

      2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

    • Size

      168KB

    • MD5

      bbf602cc98f05af58228dfc975622b04

    • SHA1

      70fb72c5217aed3c52349a3a92fda087297203b5

    • SHA256

      64dbe523c9ff1558fedaba3d2fc6476893cb2286703e69bcb30eb3015f5bd82a

    • SHA512

      bc1e3819532e0cbcc7377c5e64cb100ef211a9e6b502f0d36a14ec0b80d2378e28d3263d64071448901a8096e904a7e845124a5d7ecc2c670459f1d6e783cfcd

    • SSDEEP

      3072:lfmAD4c6xEGUAV31hECI115hswWe25ZU6GEAE+YBTVdX7lqEd+zr3/1C:lfYc6EGUYhECI3pTqjhC0fUlM

    Score
    7/10
    persistence

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks