Analysis

  • max time kernel
    75s
  • max time network
    123s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    09-07-2020 13:36

General

  • Target

    TNT INVOICE AND PACKING LIST_1.exe

  • Size

    1.5MB

  • MD5

    fff945c817bc37dfc7d9da5129f10d7c

  • SHA1

    4a31e2c8b5362300f8a0f77523c313954b89d7ba

  • SHA256

    ab261adafcaa48f8a9472a46e105f3a1a89f6b0291555e14448e445e058b9cc6

  • SHA512

    afd3cf1189b5e6e6a152b1c7ca1e29008cdd014499fba88041824051c2e0106c80d665daa0af559d8f35219a303b4094a537acdfca5ce4dba0e3d00b127a296e

Score
6/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 587 IoCs
  • Adds Run entry to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TNT INVOICE AND PACKING LIST_1.exe
    "C:\Users\Admin\AppData\Local\Temp\TNT INVOICE AND PACKING LIST_1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Adds Run entry to start application
    PID:3904
    • C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      2⤵
        PID:3920

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3920-0-0x0000000000000000-mapping.dmp

    • memory/3920-1-0x0000000000000000-mapping.dmp

    • memory/3920-2-0x0000000000000000-mapping.dmp

    • memory/3920-3-0x0000000000000000-mapping.dmp

    • memory/3920-4-0x0000000000000000-mapping.dmp

    • memory/3920-5-0x0000000000000000-mapping.dmp

    • memory/3920-6-0x0000000000000000-mapping.dmp

    • memory/3920-7-0x0000000000000000-mapping.dmp

    • memory/3920-8-0x0000000000000000-mapping.dmp

    • memory/3920-9-0x0000000000000000-mapping.dmp

    • memory/3920-10-0x0000000000000000-mapping.dmp

    • memory/3920-11-0x0000000000000000-mapping.dmp

    • memory/3920-12-0x0000000000000000-mapping.dmp

    • memory/3920-13-0x0000000000000000-mapping.dmp

    • memory/3920-14-0x0000000000000000-mapping.dmp

    • memory/3920-15-0x0000000000000000-mapping.dmp

    • memory/3920-16-0x0000000000000000-mapping.dmp

    • memory/3920-17-0x0000000000000000-mapping.dmp

    • memory/3920-18-0x0000000000000000-mapping.dmp

    • memory/3920-19-0x0000000000000000-mapping.dmp

    • memory/3920-20-0x0000000000000000-mapping.dmp

    • memory/3920-21-0x0000000000000000-mapping.dmp

    • memory/3920-22-0x0000000000000000-mapping.dmp

    • memory/3920-23-0x0000000000000000-mapping.dmp

    • memory/3920-24-0x0000000000000000-mapping.dmp

    • memory/3920-25-0x0000000000000000-mapping.dmp

    • memory/3920-26-0x0000000000000000-mapping.dmp

    • memory/3920-27-0x0000000000000000-mapping.dmp

    • memory/3920-28-0x0000000000000000-mapping.dmp

    • memory/3920-29-0x0000000000000000-mapping.dmp

    • memory/3920-30-0x0000000000000000-mapping.dmp

    • memory/3920-31-0x0000000000000000-mapping.dmp

    • memory/3920-32-0x0000000000000000-mapping.dmp

    • memory/3920-33-0x0000000000000000-mapping.dmp

    • memory/3920-34-0x0000000000000000-mapping.dmp

    • memory/3920-35-0x0000000000000000-mapping.dmp

    • memory/3920-36-0x0000000000000000-mapping.dmp

    • memory/3920-37-0x0000000000000000-mapping.dmp

    • memory/3920-38-0x0000000000000000-mapping.dmp

    • memory/3920-39-0x0000000000000000-mapping.dmp

    • memory/3920-40-0x0000000000000000-mapping.dmp

    • memory/3920-41-0x0000000000000000-mapping.dmp

    • memory/3920-42-0x0000000000000000-mapping.dmp

    • memory/3920-43-0x0000000000000000-mapping.dmp

    • memory/3920-44-0x0000000000000000-mapping.dmp

    • memory/3920-45-0x0000000000000000-mapping.dmp

    • memory/3920-46-0x0000000000000000-mapping.dmp

    • memory/3920-47-0x0000000000000000-mapping.dmp

    • memory/3920-48-0x0000000000000000-mapping.dmp

    • memory/3920-49-0x0000000000000000-mapping.dmp

    • memory/3920-50-0x0000000000000000-mapping.dmp

    • memory/3920-51-0x0000000000000000-mapping.dmp

    • memory/3920-52-0x0000000000000000-mapping.dmp

    • memory/3920-53-0x0000000000000000-mapping.dmp

    • memory/3920-54-0x0000000000000000-mapping.dmp

    • memory/3920-55-0x0000000000000000-mapping.dmp

    • memory/3920-56-0x0000000000000000-mapping.dmp

    • memory/3920-57-0x0000000000000000-mapping.dmp

    • memory/3920-58-0x0000000000000000-mapping.dmp

    • memory/3920-59-0x0000000000000000-mapping.dmp

    • memory/3920-60-0x0000000000000000-mapping.dmp

    • memory/3920-61-0x0000000000000000-mapping.dmp

    • memory/3920-62-0x0000000000000000-mapping.dmp

    • memory/3920-63-0x0000000000000000-mapping.dmp

    • memory/3920-64-0x0000000000000000-mapping.dmp

    • memory/3920-65-0x0000000000000000-mapping.dmp

    • memory/3920-66-0x0000000000000000-mapping.dmp

    • memory/3920-67-0x0000000000000000-mapping.dmp

    • memory/3920-68-0x0000000000000000-mapping.dmp

    • memory/3920-69-0x0000000000000000-mapping.dmp

    • memory/3920-70-0x0000000000000000-mapping.dmp

    • memory/3920-71-0x0000000000000000-mapping.dmp

    • memory/3920-72-0x0000000000000000-mapping.dmp

    • memory/3920-73-0x0000000000000000-mapping.dmp

    • memory/3920-74-0x0000000000000000-mapping.dmp

    • memory/3920-75-0x0000000000000000-mapping.dmp

    • memory/3920-76-0x0000000000000000-mapping.dmp

    • memory/3920-77-0x0000000000000000-mapping.dmp

    • memory/3920-78-0x0000000000000000-mapping.dmp

    • memory/3920-79-0x0000000000000000-mapping.dmp

    • memory/3920-80-0x0000000000000000-mapping.dmp

    • memory/3920-81-0x0000000000000000-mapping.dmp

    • memory/3920-82-0x0000000000000000-mapping.dmp

    • memory/3920-83-0x0000000000000000-mapping.dmp

    • memory/3920-84-0x0000000000000000-mapping.dmp

    • memory/3920-85-0x0000000000000000-mapping.dmp

    • memory/3920-86-0x0000000000000000-mapping.dmp

    • memory/3920-87-0x0000000000000000-mapping.dmp

    • memory/3920-88-0x0000000000000000-mapping.dmp

    • memory/3920-89-0x0000000000000000-mapping.dmp

    • memory/3920-90-0x0000000000000000-mapping.dmp

    • memory/3920-91-0x0000000000000000-mapping.dmp

    • memory/3920-92-0x0000000000000000-mapping.dmp

    • memory/3920-93-0x0000000000000000-mapping.dmp

    • memory/3920-94-0x0000000000000000-mapping.dmp

    • memory/3920-95-0x0000000000000000-mapping.dmp

    • memory/3920-96-0x0000000000000000-mapping.dmp

    • memory/3920-97-0x0000000000000000-mapping.dmp

    • memory/3920-98-0x0000000000000000-mapping.dmp

    • memory/3920-99-0x0000000000000000-mapping.dmp

    • memory/3920-100-0x0000000000000000-mapping.dmp

    • memory/3920-101-0x0000000000000000-mapping.dmp

    • memory/3920-102-0x0000000000000000-mapping.dmp

    • memory/3920-103-0x0000000000000000-mapping.dmp

    • memory/3920-104-0x0000000000000000-mapping.dmp

    • memory/3920-105-0x0000000000000000-mapping.dmp

    • memory/3920-106-0x0000000000000000-mapping.dmp

    • memory/3920-107-0x0000000000000000-mapping.dmp

    • memory/3920-108-0x0000000000000000-mapping.dmp

    • memory/3920-109-0x0000000000000000-mapping.dmp

    • memory/3920-110-0x0000000000000000-mapping.dmp

    • memory/3920-111-0x0000000000000000-mapping.dmp

    • memory/3920-112-0x0000000000000000-mapping.dmp

    • memory/3920-113-0x0000000000000000-mapping.dmp

    • memory/3920-114-0x0000000000000000-mapping.dmp

    • memory/3920-115-0x0000000000000000-mapping.dmp

    • memory/3920-116-0x0000000000000000-mapping.dmp

    • memory/3920-117-0x0000000000000000-mapping.dmp

    • memory/3920-118-0x0000000000000000-mapping.dmp

    • memory/3920-119-0x0000000000000000-mapping.dmp

    • memory/3920-120-0x0000000000000000-mapping.dmp

    • memory/3920-121-0x0000000000000000-mapping.dmp

    • memory/3920-122-0x0000000000000000-mapping.dmp

    • memory/3920-123-0x0000000000000000-mapping.dmp

    • memory/3920-124-0x0000000000000000-mapping.dmp

    • memory/3920-125-0x0000000000000000-mapping.dmp

    • memory/3920-126-0x0000000000000000-mapping.dmp

    • memory/3920-127-0x0000000000000000-mapping.dmp

    • memory/3920-128-0x0000000000000000-mapping.dmp

    • memory/3920-129-0x0000000000000000-mapping.dmp

    • memory/3920-130-0x0000000000000000-mapping.dmp

    • memory/3920-131-0x0000000000000000-mapping.dmp

    • memory/3920-132-0x0000000000000000-mapping.dmp

    • memory/3920-133-0x0000000000000000-mapping.dmp

    • memory/3920-134-0x0000000000000000-mapping.dmp

    • memory/3920-135-0x0000000000000000-mapping.dmp

    • memory/3920-136-0x0000000000000000-mapping.dmp

    • memory/3920-137-0x0000000000000000-mapping.dmp

    • memory/3920-138-0x0000000000000000-mapping.dmp

    • memory/3920-139-0x0000000000000000-mapping.dmp

    • memory/3920-140-0x0000000000000000-mapping.dmp

    • memory/3920-141-0x0000000000000000-mapping.dmp

    • memory/3920-142-0x0000000000000000-mapping.dmp

    • memory/3920-143-0x0000000000000000-mapping.dmp

    • memory/3920-144-0x0000000000000000-mapping.dmp

    • memory/3920-145-0x0000000000000000-mapping.dmp

    • memory/3920-146-0x0000000000000000-mapping.dmp

    • memory/3920-147-0x0000000000000000-mapping.dmp

    • memory/3920-148-0x0000000000000000-mapping.dmp