hxxps://ddei5-0-ctp[.]trendmicro[.]com/wis/clicktime/v1/query?url=https%3a%2f%2femail[.]awiiair[.]com%2fc%2feJyEk01zqj4YxT9N2NWB8CYLFlCkWqm1tmp14wQSIAUSTMKLfPr%5faO%5fiLu7Mf5lnTp7znJnzyy4U%2d%2d8f%2d2Mwmtc8wEimKDmvp0nDvufYzjzXMG8QZT4aKEVUzDLe%5fBld%2dMCIkCVtL%2drWEr%5fmGVKU%5f86xRnzDnduuY9imrZEG0frSEClRQe6eI7NI%2de2x6bCwF7iB7%2dbP7Y%5fqsSzt6uryeGuE9VRw1hCm%5fFZw3GV3F630U0Rcm9i252BdJ2ZqWFmapzkhEEHipa5GfahDR5%5frpgFtaNgzYjlWTggyUuKhuakDS%5f87V%2d2XSrUSmAGAMYCxciWZWC7ydobaJ8k7VRIk1ZMxQ4NEbSs6xsjj611vxgSYUYUaWs8qVN84A5auOlFlpK7vopkSWp39prpQpohgqPb3MJb45VB9GwCGzCosAGN5LQ5yvynzmk3j0bCmJe6auQgBjDfXs%5fWyWbrbst8fu%2dXr1mLvNFzU5nxq2iDJ14W7Xn%2duC3zdh3u4yvsv1Lmbr%5fO8a2QOYOgE5yp8jQ7VOtyGt2VPAYyNGMDQPqLe%5fC7H5%5fpHLhdvlmslZzXoL8HxevoI3eBUARiKHeFSDRFjn2mLRKXvBwBDnbmH4xnAcB0aTZpEKM%2dHU%5fRmVitSvT2bH6iH4%2d7QBcV%2dSM7pbeschzxal%5fOx30X5Npgv3dPiVa5on%2dNCeoGuhg7AeAIwPKBnAGNowSAaj0y9uwCGHC62nyKsiiBLihhGu01mL1ZZCWBIo0UylUvHuiYWH7zJK7x68qa6XGEj22GYjD%5fYMDvXy8eqwy8NzU7jV%2doe3CsHZqTV%5fMFDaOBrK7bmTm2Yd%5fxykqXuaQ1RJcc%2daqnGBS0oe1T06beireA9xUT4NUE444yRTHGhCf9%5f2iB5JzLiP5Y8Udk%5fDVxURGjqDtPln3coP%2dPN5Z%5fIKp%2doy1%5fg9D78LwAA%5f%5f9WlFGC&umid=294CDCD2-5824-0306-89F0-3FEE00E14FB5&auth=9418cb2309a08b8b272ab22a99feab0eb51fbad6-8866030f79827f4515d7fbb01720b378cbe7cc72

General

Target
https://ddei5-0-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2femail.awiiair.com%2fc%2feJyEk01zqj4YxT9N2NWB8CYLFlCkWqm1tmp14wQSIAUSTMKLfPr%5faO%5fiLu7Mf5lnTp7znJnzyy4U%2d%2d8f%2d2Mwmtc8wEimKDmvp0nDvufYzjzXMG8QZT4aKEVUzDLe%5fBld%2dMCIkCVtL%2drWEr%5fmGVKU%5f86xRnzDnduuY9imrZEG0frSEClRQe6eI7NI%2de2x6bCwF7iB7%2dbP7Y%5fqsSzt6uryeGuE9VRw1hCm%5fFZw3GV3F630U0Rcm9i252BdJ2ZqWFmapzkhEEHipa5GfahDR5%5frpgFtaNgzYjlWTggyUuKhuakDS%5f87V%2d2XSrUSmAGAMYCxciWZWC7ydobaJ8k7VRIk1ZMxQ4NEbSs6xsjj611vxgSYUYUaWs8qVN84A5auOlFlpK7vopkSWp39prpQpohgqPb3MJb45VB9GwCGzCosAGN5LQ5yvynzmk3j0bCmJe6auQgBjDfXs%5fWyWbrbst8fu%2dXr1mLvNFzU5nxq2iDJ14W7Xn%2duC3zdh3u4yvsv1Lmbr%5fO8a2QOYOgE5yp8jQ7VOtyGt2VPAYyNGMDQPqLe%5fC7H5%5fpHLhdvlmslZzXoL8HxevoI3eBUARiKHeFSDRFjn2mLRKXvBwBDnbmH4xnAcB0aTZpEKM%2dHU%5fRmVitSvT2bH6iH4%2d7QBcV%2dSM7pbeschzxal%5fOx30X5Npgv3dPiVa5on%2dNCeoGuhg7AeAIwPKBnAGNowSAaj0y9uwCGHC62nyKsiiBLihhGu01mL1ZZCWBIo0UylUvHuiYWH7zJK7x68qa6XGEj22GYjD%5fYMDvXy8eqwy8NzU7jV%2doe3CsHZqTV%5fMFDaOBrK7bmTm2Yd%5fxykqXuaQ1RJcc%2daqnGBS0oe1T06beireA9xUT4NUE444yRTHGhCf9%5f2iB5JzLiP5Y8Udk%5fDVxURGjqDtPln3coP%2dPN5Z%5fIKp%2doy1%5fg9D78LwAA%5f%5f9WlFGC&umid=294CDCD2-5824-0306-89F0-3FEE00E14FB5&auth=9418cb2309a08b8b272ab22a99feab0eb51fbad6-8866030f79827f4515d7fbb01720b378cbe7cc72
Sample260803-raq2gastbv

Score

7^/10

discovery phishing

Malware Config

Targets

- Target
  https://ddei5-0-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2femail.awiiair.com%2fc%2feJyEk01zqj4YxT9N2NWB8CYLFlCkWqm1tmp14wQSIAUSTMKLfPr%5faO%5fiLu7Mf5lnTp7znJnzyy4U%2d%2d8f%2d2Mwmtc8wEimKDmvp0nDvufYzjzXMG8QZT4aKEVUzDLe%5fBld%2dMCIkCVtL%2drWEr%5fmGVKU%5f86xRnzDnduuY9imrZEG0frSEClRQe6eI7NI%2de2x6bCwF7iB7%2dbP7Y%5fqsSzt6uryeGuE9VRw1hCm%5fFZw3GV3F630U0Rcm9i252BdJ2ZqWFmapzkhEEHipa5GfahDR5%5frpgFtaNgzYjlWTggyUuKhuakDS%5f87V%2d2XSrUSmAGAMYCxciWZWC7ydobaJ8k7VRIk1ZMxQ4NEbSs6xsjj611vxgSYUYUaWs8qVN84A5auOlFlpK7vopkSWp39prpQpohgqPb3MJb45VB9GwCGzCosAGN5LQ5yvynzmk3j0bCmJe6auQgBjDfXs%5fWyWbrbst8fu%2dXr1mLvNFzU5nxq2iDJ14W7Xn%2duC3zdh3u4yvsv1Lmbr%5fO8a2QOYOgE5yp8jQ7VOtyGt2VPAYyNGMDQPqLe%5fC7H5%5fpHLhdvlmslZzXoL8HxevoI3eBUARiKHeFSDRFjn2mLRKXvBwBDnbmH4xnAcB0aTZpEKM%2dHU%5fRmVitSvT2bH6iH4%2d7QBcV%2dSM7pbeschzxal%5fOx30X5Npgv3dPiVa5on%2dNCeoGuhg7AeAIwPKBnAGNowSAaj0y9uwCGHC62nyKsiiBLihhGu01mL1ZZCWBIo0UylUvHuiYWH7zJK7x68qa6XGEj22GYjD%5fYMDvXy8eqwy8NzU7jV%2doe3CsHZqTV%5fMFDaOBrK7bmTm2Yd%5fxykqXuaQ1RJcc%2daqnGBS0oe1T06beireA9xUT4NUE444yRTHGhCf9%5f2iB5JzLiP5Y8Udk%5fDVxURGjqDtPln3coP%2dPN5Z%5fIKp%2doy1%5fg9D78LwAA%5f%5f9WlFGC&umid=294CDCD2-5824-0306-89F0-3FEE00E14FB5&auth=9418cb2309a08b8b272ab22a99feab0eb51fbad6-8866030f79827f4515d7fbb01720b378cbe7cc72
Score

7^/10

discovery phishing
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1