Analysis
-
max time kernel
44s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:11
Static task
static1
Behavioral task
behavioral1
Sample
scan00465.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
scan00465.pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
scan00465.pdf.exe
-
Size
1.2MB
-
MD5
52555fd6673c6f44b7b57d6e1833d1ef
-
SHA1
6c7dc7a759845917b43da8d5dd73e8f34623adff
-
SHA256
9ae31235da17306c07a77f94a3541a835f0033df9bc7636a39c984e8cea9e72a
-
SHA512
a217c4dc99f575c76d3894f2a4e78d810d00a8e5423093c3e9e622b4f94f46261efb74be76278d72c139f0196d20774ecc0ceb2f670768932fcf4e439df38847
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt
masslogger
Extracted
Protocol: smtp- Host:
mail.saritatravels.com - Port:
587 - Username:
[email protected] - Password:
sumits%$321
Signatures
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule behavioral1/memory/1800-57-0x0000000000640000-0x0000000000648000-memory.dmp coreentity -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/1800-58-0x0000000006380000-0x0000000006438000-memory.dmp rezer0 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
scan00465.pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation scan00465.pdf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 15 IoCs
Processes:
scan00465.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 scan00465.pdf.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 scan00465.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 scan00465.pdf.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook scan00465.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook scan00465.pdf.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 scan00465.pdf.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook scan00465.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 scan00465.pdf.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook scan00465.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 scan00465.pdf.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 scan00465.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook scan00465.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 scan00465.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook scan00465.pdf.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 scan00465.pdf.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
scan00465.pdf.exedescription pid process target process PID 1800 set thread context of 1680 1800 scan00465.pdf.exe scan00465.pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
scan00465.pdf.exescan00465.pdf.exepid process 1800 scan00465.pdf.exe 1680 scan00465.pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
scan00465.pdf.exescan00465.pdf.exedescription pid process Token: SeDebugPrivilege 1800 scan00465.pdf.exe Token: SeDebugPrivilege 1680 scan00465.pdf.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
scan00465.pdf.exedescription pid process target process PID 1800 wrote to memory of 1716 1800 scan00465.pdf.exe schtasks.exe PID 1800 wrote to memory of 1716 1800 scan00465.pdf.exe schtasks.exe PID 1800 wrote to memory of 1716 1800 scan00465.pdf.exe schtasks.exe PID 1800 wrote to memory of 1716 1800 scan00465.pdf.exe schtasks.exe PID 1800 wrote to memory of 1680 1800 scan00465.pdf.exe scan00465.pdf.exe PID 1800 wrote to memory of 1680 1800 scan00465.pdf.exe scan00465.pdf.exe PID 1800 wrote to memory of 1680 1800 scan00465.pdf.exe scan00465.pdf.exe PID 1800 wrote to memory of 1680 1800 scan00465.pdf.exe scan00465.pdf.exe PID 1800 wrote to memory of 1680 1800 scan00465.pdf.exe scan00465.pdf.exe PID 1800 wrote to memory of 1680 1800 scan00465.pdf.exe scan00465.pdf.exe PID 1800 wrote to memory of 1680 1800 scan00465.pdf.exe scan00465.pdf.exe PID 1800 wrote to memory of 1680 1800 scan00465.pdf.exe scan00465.pdf.exe PID 1800 wrote to memory of 1680 1800 scan00465.pdf.exe scan00465.pdf.exe -
outlook_office_path 1 IoCs
Processes:
scan00465.pdf.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 scan00465.pdf.exe -
outlook_win_path 1 IoCs
Processes:
scan00465.pdf.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 scan00465.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\scan00465.pdf.exe"C:\Users\Admin\AppData\Local\Temp\scan00465.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LOPSNfzrlbcrm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp20BB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\scan00465.pdf.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp20BB.tmpFilesize
1KB
MD5750e658b9a9e6f1d2af0e0294db0d4b4
SHA16774c7985bc6b525a9bca5c6ad9fe9ecca1a26c7
SHA2560608abf78a095ecbf0cdfb0ffdbb2b050adc5c75b7170e3d7dda30990dc2cfea
SHA512fae267723e875145736030791c6efd3a61ca2dd6f4c89098dd9dca0888f8b8de8d772aec425388a7330f892c0b8096d7b775ea21e885e447de16493b123781b6
-
memory/1680-87-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-107-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-585-0x0000000000770000-0x0000000000784000-memory.dmpFilesize
80KB
-
memory/1680-85-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-582-0x00000000007D0000-0x0000000000814000-memory.dmpFilesize
272KB
-
memory/1680-123-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-61-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-62-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-64-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-65-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-66-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-67-0x00000000004AB99E-mapping.dmp
-
memory/1680-69-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-71-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-73-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-89-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-77-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-79-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-81-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-83-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-584-0x0000000000F05000-0x0000000000F16000-memory.dmpFilesize
68KB
-
memory/1680-121-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-75-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-91-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-93-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-95-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-97-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-99-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-101-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-103-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-105-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-119-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-109-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-111-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-113-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-115-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1680-117-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1716-59-0x0000000000000000-mapping.dmp
-
memory/1800-56-0x0000000074E91000-0x0000000074E93000-memory.dmpFilesize
8KB
-
memory/1800-58-0x0000000006380000-0x0000000006438000-memory.dmpFilesize
736KB
-
memory/1800-55-0x0000000000FB0000-0x000000000107E000-memory.dmpFilesize
824KB
-
memory/1800-54-0x0000000001090000-0x00000000011C0000-memory.dmpFilesize
1.2MB
-
memory/1800-57-0x0000000000640000-0x0000000000648000-memory.dmpFilesize
32KB