General

  • Target

    http://l.service01.email-allstate.com/rts/go2.aspx?h=799646&tp=i-16EB-A2-boz-3fe2iv-1z-DBGzr-1c-OdOV-lB9TvFR5aB-1dycYz&pi=RIdEuTLNtUTvRCFd3tqBNoyOremqbNq-SKxrdqUHCSk&x=%7cP_CLAIMS_EOB7B_FREEFORMTEXT_T%7c20220815%7c&hp2=fc192c0c11afbe54227f8af175b32a7ba167247a4e8508ee121807164cac9504

  • Sample

    241122-tgwlmszmbj

Malware Config

Targets

    • Target

      http://l.service01.email-allstate.com/rts/go2.aspx?h=799646&tp=i-16EB-A2-boz-3fe2iv-1z-DBGzr-1c-OdOV-lB9TvFR5aB-1dycYz&pi=RIdEuTLNtUTvRCFd3tqBNoyOremqbNq-SKxrdqUHCSk&x=%7cP_CLAIMS_EOB7B_FREEFORMTEXT_T%7c20220815%7c&hp2=fc192c0c11afbe54227f8af175b32a7ba167247a4e8508ee121807164cac9504

    • Detected bankofmontreal phishing page

    • A potential corporate email address has been identified in the URL: 97021C8B53295DF30A490D4D@AdobeOrg

MITRE ATT&CK Enterprise v15

Tasks