e47294fb83f7abeec9f8e81cf403f70a35c3422252ea3e818066426fc75c5b6e

Analysis

max time kernel
119s
max time network
121s
platform
windows10_x64
resource
win10v20210408
submitted
08/06/2021, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Urgent Contract Order GH7856648,pdf.exe
Size 665KB
Sample210608-64e64x75px
SHA256 e47294fb83f7abeec9f8e81cf403f70a35c3422252ea3e818066426fc75c5b6e
MD5 b5a7a961e776d409a8853aaf0368f46b
SHA1 7a6554c017c2d41a0479b79ef0ed4ead17e59792
SHA512 24875d8cb28bf6b43953a0e325aaa9976e60745fce4a9a4a428f799c78b3bc1558f3fca5462a63fadef5905fb0cb6e7f68a39b8c7a8e66b9278f418814c7cf06
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.tokyocornpo.com
Port
587
Username
[email protected]
Password
omQhbG$5

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	checkip.dyndns.org
18	freegeoip.app
19	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 624 set thread context of 3032	624	Urgent Contract Order GH7856648,pdf.exe	78

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3032	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 3032	624	Urgent Contract Order GH7856648,pdf.exe	78
PID 624 wrote to memory of 3032	624	Urgent Contract Order GH7856648,pdf.exe	78
PID 624 wrote to memory of 3032	624	Urgent Contract Order GH7856648,pdf.exe	78
PID 624 wrote to memory of 3032	624	Urgent Contract Order GH7856648,pdf.exe	78
PID 624 wrote to memory of 3032	624	Urgent Contract Order GH7856648,pdf.exe	78
PID 624 wrote to memory of 3032	624	Urgent Contract Order GH7856648,pdf.exe	78
PID 624 wrote to memory of 3032	624	Urgent Contract Order GH7856648,pdf.exe	78
PID 624 wrote to memory of 3032	624	Urgent Contract Order GH7856648,pdf.exe	78
PID 3032 wrote to memory of 3756	3032	MSBuild.exe	79
PID 3032 wrote to memory of 3756	3032	MSBuild.exe	79
PID 3032 wrote to memory of 3756	3032	MSBuild.exe	79

C:\Users\Admin\AppData\Local\Temp\Urgent Contract Order GH7856648,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Urgent Contract Order GH7856648,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:3756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-121-0x0000000005480000-0x0000000005481000-memory.dmp

Download

memory/624-122-0x0000000005540000-0x000000000555E000-memory.dmp

Download

memory/624-117-0x0000000005880000-0x0000000005881000-memory.dmp

Download

memory/624-118-0x0000000005380000-0x0000000005381000-memory.dmp

Download

memory/624-119-0x0000000005380000-0x000000000587E000-memory.dmp

Download

memory/624-120-0x0000000002D80000-0x0000000002D81000-memory.dmp

Download

memory/624-116-0x00000000052E0000-0x00000000052E1000-memory.dmp

Download

memory/624-123-0x0000000006FC0000-0x0000000007034000-memory.dmp

Download

memory/624-114-0x0000000000920000-0x0000000000921000-memory.dmp

Download

memory/624-124-0x0000000007080000-0x00000000070B5000-memory.dmp

Download

memory/3032-125-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3032-131-0x0000000005610000-0x0000000005B0E000-memory.dmp

Download

memory/3032-133-0x00000000065E0000-0x00000000065E1000-memory.dmp

Download