9b014c313cb7df1b9724168c06fe205203082bf646a8b15242d0c4b22cb276d3 | Triage

Sharing

General

Target

9b014c313cb7df1b9724168c06fe205203082bf646a8b15242d0c4b22cb276d3
Size

127KB
Sample

221125-wde6lagc61
MD5

a6a0454626fbc4448f104090995482c6
SHA1

70d64347417200291f834ba34b25cd72df297d12
SHA256

9b014c313cb7df1b9724168c06fe205203082bf646a8b15242d0c4b22cb276d3
SHA512

a2123685d6e97ac06a788ea0887918ea7b0ca765a75b6361e8f222d7a7843f1b25ec542210a0dfa92cec5a6f36e468dace7f7cc5f0d937db63d1023982668856
SSDEEP

3072:6zireMNALp+CSYnzyHyvBwwQlF9KwrrzFmwzDqrRIy:6zeeMspaYzyHeBzQJPrrpHKrKy

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
- Size
  
  176KB
- MD5
  
  0bdbb242c3d65c99b0c4b3bdad19a793
- SHA1
  
  1b2a37b64b1a7ca71b801125faca273408bb7e67
- SHA256
  
  942b643d07c0cb4ac1593dccd846fe4bcda402f5f74fa4ba1437248e7c89e0c3
- SHA512
  
  387c6455dc286989d0de8b418505b5453ce82c262132eba2975006b59057a698bb5fe33bfa428690d0db30b3396ba6b699a1ad2b68482bc04df27975ca19206e
- SSDEEP
  
  3072:bBfHcmI+fMEJRvGGs4Edlb9kMv0UNLp+CSYnzyZyvBwwQlF9KwrrznF19AaROhze:blH80NJ5ZEdT8UlpaYzyZeBzQJPrrjFt
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2