80b3c8d9dcccf09f2cd697875d417ecfd90dc7ce3132ef10bc5d6f48510d19da

General

Target
SIPARIS TEYIT FORMU VE PROFORMA FATURA.exe
Size 1.1MB
Sample241208-fb83wstkcx
SHA256 80b3c8d9dcccf09f2cd697875d417ecfd90dc7ce3132ef10bc5d6f48510d19da
MD5 46e6e1de1b6d73f5a54ff291d8efc05b
SHA1 f3d6426ff9e3190ca0416d4015d8d67bbf807868
SHA512 f618c4e2e48294b7bb2630beabdfec9680f7e96b229e68a4cbb285701690cd3fb71f1b8a524c3dd82a4bd0083d171099875e206b19cab8e47f4143d4698324fe
SSDEEP 24576:Hu6J33O0c+JY5UZ+XC0kGso6FaVoSg2zSUN6wyU0WY:Bu0c++OCvkGs9FaaSgDu6uY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery

Malware Config

Targets

- Target
  SIPARIS TEYIT FORMU VE PROFORMA FATURA.exe
- Size 1.1MB
- SHA256 80b3c8d9dcccf09f2cd697875d417ecfd90dc7ce3132ef10bc5d6f48510d19da
- MD5 46e6e1de1b6d73f5a54ff291d8efc05b
- SHA1 f3d6426ff9e3190ca0416d4015d8d67bbf807868
- SHA512 f618c4e2e48294b7bb2630beabdfec9680f7e96b229e68a4cbb285701690cd3fb71f1b8a524c3dd82a4bd0083d171099875e206b19cab8e47f4143d4698324fe
- SSDEEP 24576:Hu6J33O0c+JY5UZ+XC0kGso6FaVoSg2zSUN6wyU0WY:Bu0c++OCvkGs9FaaSgDu6uY
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

collection discovery
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops startup file

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2