Overview

overview

7

Static

static

2014_11rec...bh.exe

windows7-x64

7

2014_11rec...bh.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    34ac94d4483fe75b414b17fee0259f213ba750b295a584830910f79af75ff450

  • Size

    225KB

  • Sample

    221125-dgk7xafh36

  • MD5

    8c4842fa16e7ea1c455216c5be193e87

  • SHA1

    0e8f44057af8f4f685652b5140caa7924da556ee

  • SHA256

    34ac94d4483fe75b414b17fee0259f213ba750b295a584830910f79af75ff450

  • SHA512

    29897d92f3d78067f564a85e87b1dae33b664af6e46b4397d9472fe5e54a2368c65cc85c777c5af2ca078354f52eb54b33231da47ec7a569047a3ac5aed095bf

  • SSDEEP

    6144:6o9fugZp2b5+Yu+8goNOBazN8O5O3gN9lKvJrNaVWQbv:6KmgZpfPNrL5sg4JrYBv

Score
7/10
discoverypersistence

Malware Config

Targets

    • Target

      2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe

    • Size

      306KB

    • MD5

      756fae3b80bf129ce578006534c1413f

    • SHA1

      00ec3c18110067acd9014a27c366160f2ea18ab3

    • SHA256

      69b81b054100dc55fa61aa0edb9acdecccb84ab84fa37177b33e5d9814067633

    • SHA512

      10274e2d15f6c7990acee9dd6b8e4d3b30c5dc810321198257671862f125baecede3cb5193468f8361d3289fb4623cb3ab6a9f0caceb780eaa6e0e4ef4d1626e

    • SSDEEP

      6144:Ci37LbbWiaYUpwXV9RIKWn/TUVs8oL48N8lqFzc+tRJShtvUdJk:CO/izXrN8UbtPShoJk

    Score
    7/10
    persistencediscovery

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Network Service Scanning

1
T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks