Overview

overview

7

Static

static

rechnung_1...05.exe

windows7-x64

7

rechnung_1...05.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    80b4082c3ea7ac9793143fd390fee292084db68bd2767332561506ba92f90694

  • Size

    128KB

  • Sample

    221124-rgvcgada2t

  • MD5

    b5e4c2abc8f48454058e1802d4052bb9

  • SHA1

    a5c1a7456b94fdb0eaa7a82f583900a085de7522

  • SHA256

    80b4082c3ea7ac9793143fd390fee292084db68bd2767332561506ba92f90694

  • SHA512

    f4f9ecd9a22e00fb230a7b894080cda9aca9025a79d4bc7dc0dc84cc5f60f9d037b1e8a9c4d42b5e2193b1601e5e5158c080de939bd25a3f3d59dcff0bcc8738

  • SSDEEP

    3072:0dGfhki0Sg4p5d5LSJ0NpCkvaIwrcixkqelnyQVYoP4vVyM:QihQS6wQIgcixClyQf6yM

Score
7/10
persistence

Malware Config

Targets

    • Target

      rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe

    • Size

      196KB

    • MD5

      7c401bde8cafc5b745b9f65effbd588f

    • SHA1

      b5691ee02fb8560e6143785087ce465e0c88cf08

    • SHA256

      47b2a9c7db77b6cd600ffaa2f4691cd772c1a703477b9906942ceda5fb2edb0d

    • SHA512

      10cf7eaf9da0692f91ae8f8a42a970c9083605440c733ff8220f5f9d3783c74e0c94713e83a9b0341289a30d23ba843a18a828601e4d2699ad8b1fe0ea1be3a1

    • SSDEEP

      3072:tj6nX6bQwg4p5d5LSJ0NpCkvYIwrcixkqelXjChTW3JbbeGI6Ja:90qcw6wKIgcixClzChKoGLa

    Score
    7/10
    persistence

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks