5565683f673e9d6805249815f7595bb2d0b9c2d2a8402059c9266e99efe4b2a0

General

Target
NARESCO CONTRACTING - MELANITE ENERGY FACTORY/Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Size 688KB
Sample260804-gx93raec52
SHA256 5565683f673e9d6805249815f7595bb2d0b9c2d2a8402059c9266e99efe4b2a0
MD5 77314b599c791bea2f2f51964cc6ebde
SHA1 c4adb1033dfbe710a59e66179f8c67452853fcf0
SHA512 741d52331a395d6dbe9b437a6303ba14166a4d2181861e8a5f875bf47f24343489ffffde8b314e18fdd83b927dd19faea67bed25342a61196c940b701e6f7ebd
SSDEEP 12288:vhdj8DwvNX/mzpGp5KWW50/UIqdzwHJem7OzwHJe0Ihf1q:3j8DwvItGpYW3/UIqxwpemIwpelNq
TLSH
T152E49D03F34552B9E08AD5B49A439633E5723C444B6161DB2BE9BF3A3E71AD01B7932C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

collection

Malware Config

Signatures

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe

Accesses Microsoft Outlook profiles 1 TTPs 16 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3600	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe

C:\Users\Admin\AppData\Local\Temp\NARESCO CONTRACTING - MELANITE ENERGY FACTORY\Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe
"C:\Users\Admin\AppData\Local\Temp\NARESCO CONTRACTING - MELANITE ENERGY FACTORY\Scope of Work -NARESCO CONTRACTING - MELANITE ENERGY FACTORY.exe"
1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:3600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

2

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3600-4-0x00000288DB9C0000-0x00000288DB9C3000-memory.dmp

Download

memory/3600-28-0x00000288DB9C0000-0x00000288DB9C3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads