c4321f8a7c6225614746430b2f64998ef2bb9f4dcc94d8c5226c70c35eeb9039

General

Target

Payment Notification.exe
Size

381KB
MD5

673a1dd42a4ce1a314a1db4dcbf09a81
SHA1

2fdb26d92e25c38c6300123278cbcea3be6a0ecc
SHA256

684aa4d9c333d3ea5db101d239673a76f22e06ae5237ae24b00e43c55cb3b3ae
SHA512

9be66fa1b076700972797c273bce0d14594fc3cc58728e0ca5552138c9dac04152470ae70d44a7c9c6dbf2b672143085134e14a9f7c6c54cce88aa2715ad6201

Score

10^/10

collection

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.mmpsecurity.co.za
Port:
587
Username:
[email protected]
Password:
P@ss@2019

Signatures

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

InstallUtil.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
45	ifconfig.me

Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment Notification.exe

description	pid	Process	procid_target
PID 4052 set thread context of 3908	4052	Payment Notification.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Payment Notification.exeInstallUtil.exe

pid	Process
4052	Payment Notification.exe
4052	Payment Notification.exe
4052	Payment Notification.exe
3908	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Payment Notification.exeInstallUtil.exe

description	pid	Process
Token: SeDebugPrivilege	4052	Payment Notification.exe
Token: SeDebugPrivilege	3908	InstallUtil.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Payment Notification.exe

description	pid	Process	procid_target
PID 4052 wrote to memory of 3908	4052	Payment Notification.exe	85
PID 4052 wrote to memory of 3908	4052	Payment Notification.exe	85
PID 4052 wrote to memory of 3908	4052	Payment Notification.exe	85
PID 4052 wrote to memory of 3908	4052	Payment Notification.exe	85
PID 4052 wrote to memory of 3908	4052	Payment Notification.exe	85
PID 4052 wrote to memory of 3908	4052	Payment Notification.exe	85
PID 4052 wrote to memory of 3908	4052	Payment Notification.exe	85

outlook_office_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3908-135-0x0000000000000000-mapping.dmp

Download
memory/3908-136-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3908-137-0x0000000005D60000-0x0000000005DFC000-memory.dmp

Filesize
624KB

Download
memory/3908-138-0x00000000067E0000-0x00000000069A2000-memory.dmp

Filesize
1.8MB

Download
memory/3908-139-0x0000000006C20000-0x0000000006C86000-memory.dmp

Filesize
408KB

Download
memory/3908-140-0x0000000007140000-0x000000000714A000-memory.dmp

Filesize
40KB

Download
memory/4052-130-0x0000000000C90000-0x0000000000CF6000-memory.dmp

Filesize
408KB

Download
memory/4052-131-0x0000000006320000-0x00000000068C4000-memory.dmp

Filesize
5.6MB

Download
memory/4052-132-0x0000000005E70000-0x0000000005F02000-memory.dmp

Filesize
584KB

Download
memory/4052-133-0x0000000006280000-0x00000000062C4000-memory.dmp

Filesize
272KB

Download
memory/4052-134-0x0000000006900000-0x0000000006922000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads