Managed XDR

factura-7622.msg — malware analysis report

File info

Filename
factura-7622.msg
File type
CDFV2 Microsoft Outlook Message
File size
563 KB
First seen
Last seen

Environment

w10/x86 en

Hashes

SHA1
141c2833e21511408ec1a96a11d7ec2ca52b5426
SHA256
b2b019d1effcd2367013e12c7db9845a2478959ab3e369281d8e8d37c3ca4c95
MD5
7b53f9aedcaf1f38174fe2f0d1229cc8

Signatures

Execution

T1059 nsis_suspicious_filenames: Nsis contains files with suspicious names

Persistence

T1574 dropper_dll: Creates DLL, which is then loaded into the process

Privilege Escalation

T1055.012 injection_runpe: Injects code into another process
T1055 injection_thread: Code injection to a remote process using CreateRemoteThread or NtQueueApcThread
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1055.012 injection_runpe: Injects code into another process
T1055 injection_thread: Code injection to a remote process using CreateRemoteThread or NtQueueApcThread
T1562 dep_disable: Disables DEP
T1497 antidbg_setinformationthread: Attempts to evade debugger using NtSetInformationThread
T1497.003 antisandbox_idletime: Detects Windows Idle Time to determine the uptime
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1027.002 nsis_archive: One of the packages is NSIS archive
T1027.002 nsis_suspicious_filenames: Nsis contains files with suspicious names

Credential Access

T1552 infostealer_mail: Collects personal data from local email clients
T1552 infostealer_browser: Retrieves personal information from local Internet browsers
T1552 infostealer_im: Collects information about installed messengers
T1503 infostealer_browser: Retrieves personal information from local Internet browsers
T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files

Discovery

T1497 antidbg_setinformationthread: Attempts to evade debugger using NtSetInformationThread
T1497.003 antisandbox_idletime: Detects Windows Idle Time to determine the uptime
T1497.003 antisandbox_sleep: The process attempted to slow down analysis

Collection

T1114 infostealer_mail: Collects personal data from local email clients

Command and Control

T1102.003 cloud_google: Connects to cloud services of Google (potentially for malicious payload delivery)
T1071.001 network_http: Performs HTTP requests

Other

suricata_alert: Malicious traffic detected
ip_domains: Identifies an IP address using external resources
telegram_api: Telegram Messenger API is used
no_graphical_activity: No graphic activity
creates_exe: Creates executable files in the file system
pe_overlay: PE file contains overlay