3c4e72cd76e2a0e1768f28bbd82dd313e021d99f3926a62b51088a43b2770101 | Triage

Sharing

General

Target

3c4e72cd76e2a0e1768f28bbd82dd313e021d99f3926a62b51088a43b2770101
Size

123KB
Sample

221127-trd5caef4t
MD5

b5921f3d2682301a548a3aef103a5b44
SHA1

438c2e567bd38901b8a87c6c5a11627324d93def
SHA256

3c4e72cd76e2a0e1768f28bbd82dd313e021d99f3926a62b51088a43b2770101
SHA512

65d8d336217b1bfd763a897cee836233149e7d8525baf94865a745e88d11310b7d8d8551af5acd4511db4fd9fb776e3442f8517e755a2c626bffb4c20b217d4e
SSDEEP

3072:/WYrvIWPo9iCQtU8AuXhhH+7Zm1wdEb9luxPHsHvi4As0:/jHPe+UbuRhH+md0P9

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
- Size
  
  148KB
- MD5
  
  9d98c00e6856de4478554ffaa7d186b2
- SHA1
  
  10f4dc27fc03d5e31f1050607c3d91a733b95a37
- SHA256
  
  79f402d1a823a6c96389483aab9744640aa310546045f6ec76d491b0d9db356b
- SHA512
  
  5ecfdd934ebe17a4835d6c08f124c3c2bf66a9a006e8438cd9ab0c33403d037e769477946faff0e465588385ae416bce46eb6524e67b6cdad3405bb3a18c8a5f
- SSDEEP
  
  3072:Dku/PN/dw7QrkU8AuXhhHK7Zm1wdEb9leB0pPMMxgf6:wePN//kUbuRhHKmdhVMagf6
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2