1eda1b310543e616e8b7b97e8e5f13597fb3a67ed9658b3daba2f49361563689

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PI No. LS-E20221125.exe
Size 1.0MB
Sample231010-nlkr2sfa84
SHA256 1eda1b310543e616e8b7b97e8e5f13597fb3a67ed9658b3daba2f49361563689
MD5 9473912851ada9725dc1e070074b16c8
SHA1 694bc96f08b21c2d944adbec5878ae1e464b4c75
SHA512 b9fa145e3776508136e581f4bf97c872f66e2e8bd2e9232dbe511ce60462d1bba9458cee5fe0d4812b019c6db559d794b69afa01312560c06a5a1f959bf4dfe8
SSDEEP 24576:NDdj2EVDWRWZMM434lIJ/B5n2RyBzUQP+yQM5:NDd2EooO5T1BzUlyQM5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.etasimali.com
Port
587
Username
[email protected]
Password
RECRUTEMENT@2023

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2580	PI No. LS-E20221125.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
6	api.ipify.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2284	caspol.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2580	PI No. LS-E20221125.exe
2284	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2580 set thread context of 2284	2580	PI No. LS-E20221125.exe	28

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\teleskopaffjedrings.ini	PI No. LS-E20221125.exe
File opened for modification	C:\Windows\Fonts\svovldioxidudsendelsens.abr	PI No. LS-E20221125.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2284	caspol.exe
2284	caspol.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2580	PI No. LS-E20221125.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	caspol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2284	caspol.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2284	2580	PI No. LS-E20221125.exe	28
PID 2580 wrote to memory of 2284	2580	PI No. LS-E20221125.exe	28
PID 2580 wrote to memory of 2284	2580	PI No. LS-E20221125.exe	28
PID 2580 wrote to memory of 2284	2580	PI No. LS-E20221125.exe	28
PID 2580 wrote to memory of 2284	2580	PI No. LS-E20221125.exe	28
PID 2580 wrote to memory of 2284	2580	PI No. LS-E20221125.exe	28

C:\Users\Admin\AppData\Local\Temp\PI No. LS-E20221125.exe
"C:\Users\Admin\AppData\Local\Temp\PI No. LS-E20221125.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\PI No. LS-E20221125.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 b81f2e602f668763b3a95ed3551c508193ac37a57de22ce2c0fa94033f59a545
MD5 2f272d6988e9bb3d18ddef9257efe9d4
SHA1 01af9b3310864b52e0c36298dfdf9c03e006a1d9
SHA512 836e6d644d04b20feb395fa54ccd7cb88ce2c816c81cdfc6a5d597b1ab4913ce3beea2f18242641a5354f2e2a376e354731a0ceaec9f28a88a7ed3cc00b444b8
MD5 SHA1 SHA512

Submit Download

CabAE99.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabAE99.tmp
Size 61KB
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
SSDEEP 1536:RfhMeKBlsociYZAT+4oGNk2rb2oX3bUH+uOlEU:RhV0WXvAa4XNoeudU
MD5 SHA1 SHA512 SSDEEP

Submit Download

TarAF28.tmp

Path C:\Users\Admin\AppData\Local\Temp\TarAF28.tmp
Size 163KB
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
SSDEEP 1536:AA8JXlCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6t+:AtJXq0RuXCyfdmAyru2/RAKtU
MD5 SHA1 SHA512 SSDEEP

Submit Download

teleskopaffjedrings.ini

Path C:\Windows\Resources\0409\teleskopaffjedrings.ini
Size 32B
SHA256 d95e5104f5be78439d76c369d624b18979ea1ad848cee45cdc7e1efaf4dceae2
MD5 a14c8952b6a9de03f50d9fcb1bd3ce0f
SHA1 3fbcf74119646aa075fa8abc170ecbdc359c63e8
SHA512 231c437fe738f6ff3a075f93f32d1c743e6b21ea715469472129bd3b797efc014254bb825cbb341bb0bd4d21a2be11ba19cbe744fe71e29cd6256a5cb785b69b
MD5 SHA1 SHA512

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nso42EB.tmp\System.dll
Size 11KB
SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
MD5 b0c77267f13b2f87c084fd86ef51ccfc
SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2284-36-0x00000000731D0000-0x0000000073212000-memory.dmp

Download

memory/2284-33-0x00000000731D0000-0x0000000074232000-memory.dmp

Download

memory/2284-34-0x0000000000490000-0x0000000003BAD000-memory.dmp

Download

memory/2284-32-0x0000000077C40000-0x0000000077DE9000-memory.dmp

Download

memory/2284-37-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Download

memory/2284-38-0x0000000036570000-0x00000000365B0000-memory.dmp

Download

memory/2284-111-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Download

memory/2284-112-0x0000000036570000-0x00000000365B0000-memory.dmp

Download

memory/2580-31-0x0000000075190000-0x0000000075196000-memory.dmp

Download

memory/2580-30-0x0000000077E30000-0x0000000077F06000-memory.dmp

Download

memory/2580-29-0x0000000077C40000-0x0000000077DE9000-memory.dmp

Download