Analysis
- max time kernel
94s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
01/05/2023, 14:41
General
- Target Invoice No 2023-27-04 037 for prepayment of 100 MT.exe
- Size 917KB
- Sample230501-r2eshshe51
- SHA256 e5576bd4af80125cef4bbaf71b357486fde975fce56ff17c782644933d542828
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice No 2023-27-04 037 for prepayment of 100 MT.exe"C:\Users\Admin\AppData\Local\Temp\Invoice No 2023-27-04 037 for prepayment of 100 MT.exe"1⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wFWpJfxHEVhNWg.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wFWpJfxHEVhNWg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB8F0.tmp"2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0s2wq2fi.5jg.ps1
tmpB8F0.tmp
memory/3168-159-0x0000000002910000-0x0000000002920000-memory.dmp
memory/3168-175-0x0000000007BB0000-0x000000000822A000-memory.dmp
memory/3168-182-0x0000000007890000-0x0000000007898000-memory.dmp
memory/3168-181-0x00000000078B0000-0x00000000078CA000-memory.dmp
memory/3168-160-0x0000000002910000-0x0000000002920000-memory.dmp
memory/3168-144-0x0000000004D00000-0x0000000004D36000-memory.dmp
memory/3168-145-0x0000000005370000-0x0000000005998000-memory.dmp
memory/3168-179-0x00000000077F0000-0x0000000007886000-memory.dmp
memory/3168-147-0x0000000005A50000-0x0000000005A72000-memory.dmp
memory/3168-148-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/3168-178-0x00000000075E0000-0x00000000075EA000-memory.dmp
memory/3168-161-0x0000000006260000-0x000000000627E000-memory.dmp
memory/3168-177-0x000000007F5A0000-0x000000007F5B0000-memory.dmp
memory/3168-180-0x00000000077A0000-0x00000000077AE000-memory.dmp
memory/3168-151-0x0000000005BE0000-0x0000000005C46000-memory.dmp
memory/3168-162-0x0000000002910000-0x0000000002920000-memory.dmp
memory/3168-163-0x0000000007230000-0x0000000007262000-memory.dmp
memory/3168-164-0x000000006F110000-0x000000006F15C000-memory.dmp
memory/3168-174-0x0000000006820000-0x000000000683E000-memory.dmp
memory/3168-176-0x0000000007570000-0x000000000758A000-memory.dmp
memory/3596-133-0x00000000005E0000-0x00000000006CA000-memory.dmp
memory/3596-136-0x0000000005030000-0x0000000005040000-memory.dmp
memory/3596-134-0x00000000056D0000-0x0000000005C74000-memory.dmp
memory/3596-135-0x0000000005120000-0x00000000051B2000-memory.dmp
memory/3596-139-0x0000000006DF0000-0x0000000006E8C000-memory.dmp
memory/3596-138-0x0000000005030000-0x0000000005040000-memory.dmp
memory/3596-137-0x00000000050A0000-0x00000000050AA000-memory.dmp