Overview

overview

7

Static

static

rechnung_1...05.exe

windows7-x64

7

rechnung_1...05.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b3ea9a4d2c0283e12fac8ded0996251da293b02b9ddb975c311a4ee381528412

  • Size

    146KB

  • Sample

    221124-lzm38afb92

  • MD5

    8eb97695b5e2dd0e1ede5da50418861d

  • SHA1

    714d76eadcdacd5181439c2f7219419e9ee82ad6

  • SHA256

    b3ea9a4d2c0283e12fac8ded0996251da293b02b9ddb975c311a4ee381528412

  • SHA512

    0070146c748e48780c2c4e549ff6a5f6fcefd6426c8c41cd853c2cca868afc463d5bfd9f84073bc9547550ff283b0c24c603d6aca2d86521881aaf96755d3f83

  • SSDEEP

    3072:XuL4suyftDcmLDLYYJQEIigwkZM7QWtcJWjRzvNNcIdlwC09BJQG:XuL48ftDcmHz7PgDZJkjRzVOqnUMG

Score
7/10
persistence

Malware Config

Targets

    • Target

      rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe

    • Size

      176KB

    • MD5

      4a1d13a05a93cfaa8dd2627c696d2f0b

    • SHA1

      173c81da2aab91f225f8eb5e8fcc87119be4eff0

    • SHA256

      03f825726fdf3341bcfa36fcfd6dcd08e9d7ec3df982f7af9a290aa6f3c5647c

    • SHA512

      29269b35d3b041ccf08d2351e4f3fa906ed396e5a880b357398f2f72ba7a20ff870531b2d7febaa1e4173412074d6bc7bee5723ad683011ee4a247fb683e7301

    • SSDEEP

      3072:q6AMa+ceqZl+r4okWL23kjsZUQoRyV01WZIrLwwWyKdMd9zfp0T0:VfzsbWa3hZUHRHwwWy8UO4

    Score
    7/10
    persistence

    • Deletes itself

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks