Extracted

• • Target
    AJANAIMPEX-RFQ TRI755.exe
  • Size 3.1MB
  • SHA256 e388eb34fe4d280633609f6acec12a3e73c288f8b69ce402c3d24c0d0f5524f3
  • MD5 649a42628af11e7484faa1ca0e20362d
  • SHA1 6c96ee0d6b7d1a0a7927178dad35b85532108295
  • SHA512 815618a3f9ab0c8efa3523bd9bd6bdd02320bd14dfa78927856c63b4b1c94227e9e53ed2de1813c7edfa1f348c9cc05dff83cca706237720b7fa4670b3ad3cc5
  • SSDEEP 49152:Ya5IaG5gtern9ahApw4X0C+Lp8vSsraJXQyh7zus5FiJk7TLVT/Z9LeB:YiIagz7VN0C8KsBlE
  • TLSH
    T176E59E5673E841E8F0B7D6B4CEA68213EFB37C451732C65F02988A5A1F23B615E39721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverypersistence

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Downloads MZ/PE file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    msvcp140.dll
  • Size 540KB
  • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
  • MD5 4e3fa9bd90ef020c14359639dc19312b
  • SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
  • SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
  • SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
  • TLSH
    T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    tbbmalloc.dll
  • Size 1.8MB
  • SHA256 62bdbdaaf5eafc7b6d3a88311a377148ef4454b030e56b0a9154ed1c421d8eb8
  • MD5 aaae4a4ccd92ec6d7bcfbaa58f14234d
  • SHA1 f455f77252f1d1dc3c6af4803755c7f91485126f
  • SHA512 968739110d227c0b5f6eb215f413e35a2dc49ee4d971c35de597c4635de215c72b1479fbf074a969b67b99be9b270701a9bcb2da751495c99f6d73614773a240
  • SSDEEP 49152:G37vA8kO9EWbKDDELz8+VNAj3MukP8vr8I9uN:GWWzY3Muqi8z
  • TLSH
    T15195AD06A3D009A9D1B7E634CAA7833BC775B8450371E59F0255D68A2F73BD09E3B326
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverypersistence

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral5behavioral6
• • Target
    ucrtbase.dll
  • Size 1.3MB
  • SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
  • MD5 ef62e9b3d7203f825dbf5dda8d4770c9
  • SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
  • SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
  • SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
  • TLSH
    T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7
• • Target
    vcruntime140.dll
  • Size 120KB
  • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
  • MD5 0d35c5e99871b4f02c490b9fd9dace34
  • SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
  • SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
  • SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
  • TLSH
    T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral8behavioral9
• • Target
    vcruntime140_1.dll
  • Size 46KB
  • SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
  • MD5 03b43160d21c08de07a79d0a1c5ee81d
  • SHA1 0a449093006af667432b83303614b53b62fc0d05
  • SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
  • SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
  • TLSH
    T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral11