a6130fd1e75005e23ae4d6d76f9e16617090bd7393cf0e97a2912c58c8ab08b0 | Triage

Sharing

General

Target

a6130fd1e75005e23ae4d6d76f9e16617090bd7393cf0e97a2912c58c8ab08b0
Size

125KB
Sample

221127-sqjsrsgc58
MD5

112bcb189d336b58303793f74effe217
SHA1

29fd5c62a074fd0605085289f7199a0e8d866741
SHA256

a6130fd1e75005e23ae4d6d76f9e16617090bd7393cf0e97a2912c58c8ab08b0
SHA512

3165d64cba35d947faabbe7b8ed5822253b8f8b5181fb761a3f6671ab0875c72fbb7f8577600a473cfc12f1792e4caf0bdf3d83cabab5a3b6983dc684965abad
SSDEEP

3072:OX1nAzwFKitrqIwDIJFkcbSziQrG6PsiYyQ/HzdKc4gWEybV7:UAEF9r4ELZbSziQrG6dYyWdKcje7

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
- Size
  
  156KB
- MD5
  
  aca8bdbd8e79201892f8b46a3005744b
- SHA1
  
  284fbc4f8265e1125f6ffc16d50a5144676ced2a
- SHA256
  
  836228366d9edc7e8be6321ce1ce18204e50e6cb36ddcb4ec9c3cdb079998083
- SHA512
  
  1699ea7e18f13ca5f615773d8b278a78df9536c95684dedf5e5fcdc003cc6bb5bce73702d7d3c8bbb22459161f57e3fd85709068c8a628eeed78295dc6bdcab1
- SSDEEP
  
  3072:LdLBregqjNDitrqIwDIJFkcbS7iQrG6PsiYyQEHzdKc4gWEybV5:LdLCNar4ELZbS7iQrG6dYyxdKcje5
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2