5dff59bba594b0d87c418b49f4d867b83d39bb327409ee7f2ba160964c8422cd | Triage

Submit
Reports

Overview

overview

8

Static

static

1

CONTRACT C...df.exe

windows7-x64

8

CONTRACT C...df.exe

windows10-2004-x64

8

Sharing

General

Target

CONTRACT COPY PRN00720387_pdf.exe
Size

799KB
Sample

241121-nkhlas1ele
MD5

901aac855d2dec6202d1ec5a6424614d
SHA1

82b0bd78b511bc9fd47f11fb03a19b15e377b12d
SHA256

5dff59bba594b0d87c418b49f4d867b83d39bb327409ee7f2ba160964c8422cd
SHA512

a93d71198748878b72fbdd267b733da31745a66478756d21a0c11bed1481b352897d1bb721ff42d6ad27b3c5fd53c08a818986d684e5ef7b98bb1bf9d1a319ac
SSDEEP

12288:47LuH9zeOBbolPGOOuLwr8m+QBvlP9Ia8GIbPYkAdwvLRPC6Oe73MFcN:cL7+olPGlNAKIacPYkAevLRPJye

Score

8^/10

collection discovery evasion execution

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

CONTRACT COPY PRN00720387_pdf.exe

Resource

win7-20240903-en

discovery execution

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

CONTRACT COPY PRN00720387_pdf.exe

Resource

win10v2004-20241007-en

collection discovery evasion execution

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  CONTRACT COPY PRN00720387_pdf.exe
- Size
  
  799KB
- MD5
  
  901aac855d2dec6202d1ec5a6424614d
- SHA1
  
  82b0bd78b511bc9fd47f11fb03a19b15e377b12d
- SHA256
  
  5dff59bba594b0d87c418b49f4d867b83d39bb327409ee7f2ba160964c8422cd
- SHA512
  
  a93d71198748878b72fbdd267b733da31745a66478756d21a0c11bed1481b352897d1bb721ff42d6ad27b3c5fd53c08a818986d684e5ef7b98bb1bf9d1a319ac
- SSDEEP
  
  12288:47LuH9zeOBbolPGOOuLwr8m+QBvlP9Ia8GIbPYkAdwvLRPC6Oe73MFcN:cL7+olPGlNAKIacPYkAevLRPJye
Score

8^/10

discovery execution collection evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables Task Manager via registry modification
  evasion
- Accesses Microsoft Outlook profiles
  collection
- Blocklisted process makes network request
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecution

behavioral2

collectiondiscoveryevasionexecution

© 2018-2025

Terms | Privacy