Analysis
-
max time kernel
122s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:53
Static task
static1
Behavioral task
behavioral1
Sample
Notice of Payment.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Notice of Payment.exe
Resource
win10v2004-20220414-en
General
-
Target
Notice of Payment.exe
-
Size
347KB
-
MD5
0b7b2acd93a784e3af07bd3acaec2e97
-
SHA1
069c15a1913cd506ffc306a14075e7dd28a3d122
-
SHA256
d70b1d7ebfde15715b3e63d8b4cf75c9025de1e3744d83c78278d7e939d459de
-
SHA512
aecdfc30af77e6500c0fc5951a5bb0d476d7e932e77b3303044b26a99e6d0b328db72623e076174d6a6d56dfe792ef43d71e145d73500fc39842ef0e061e9807
Malware Config
Extracted
Protocol: smtp- Host:
mail.baconplumbing.co.za - Port:
587 - Username:
[email protected] - Password:
Andrew@1652
Signatures
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 33 ifconfig.me -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Notice of Payment.exedescription pid process target process PID 400 set thread context of 1512 400 Notice of Payment.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Notice of Payment.exeInstallUtil.exepid process 400 Notice of Payment.exe 400 Notice of Payment.exe 400 Notice of Payment.exe 1512 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Notice of Payment.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 400 Notice of Payment.exe Token: SeDebugPrivilege 1512 InstallUtil.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
Notice of Payment.exedescription pid process target process PID 400 wrote to memory of 1512 400 Notice of Payment.exe InstallUtil.exe PID 400 wrote to memory of 1512 400 Notice of Payment.exe InstallUtil.exe PID 400 wrote to memory of 1512 400 Notice of Payment.exe InstallUtil.exe PID 400 wrote to memory of 1512 400 Notice of Payment.exe InstallUtil.exe PID 400 wrote to memory of 1512 400 Notice of Payment.exe InstallUtil.exe PID 400 wrote to memory of 1512 400 Notice of Payment.exe InstallUtil.exe PID 400 wrote to memory of 1512 400 Notice of Payment.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Notice of Payment.exe"C:\Users\Admin\AppData\Local\Temp\Notice of Payment.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/400-130-0x00000000009F0000-0x0000000000A4E000-memory.dmpFilesize
376KB
-
memory/400-131-0x0000000005370000-0x0000000005392000-memory.dmpFilesize
136KB
-
memory/400-132-0x00000000060E0000-0x0000000006684000-memory.dmpFilesize
5.6MB
-
memory/400-133-0x0000000005C30000-0x0000000005CC2000-memory.dmpFilesize
584KB
-
memory/400-134-0x0000000006790000-0x00000000067D4000-memory.dmpFilesize
272KB
-
memory/1512-135-0x0000000000000000-mapping.dmp
-
memory/1512-137-0x00000000007B0000-0x00000000007D2000-memory.dmpFilesize
136KB
-
memory/1512-138-0x0000000005280000-0x000000000531C000-memory.dmpFilesize
624KB
-
memory/1512-139-0x0000000005D40000-0x0000000005F02000-memory.dmpFilesize
1.8MB
-
memory/1512-140-0x00000000061C0000-0x0000000006226000-memory.dmpFilesize
408KB
-
memory/1512-141-0x0000000006720000-0x000000000672A000-memory.dmpFilesize
40KB