LetsDefend - Email Analysis#

Start Investigation#

After downloaded both file, I started by parsing the eml file on Email Viewer and opened it on vscode at the same time

Online Email Reader works as a charm, this is what it should look like

Looking at the header it seems like the sender was not hide the actual email

Looking at the contents it says that there is an attachment came with it and the sender told the recipient to confirm it

Since the sender IP address could be seen on the email header, I searched this IP for the location and this IP address located in the Vancouver from Canada.

Now it’s time to analyze the email attachment

Just at first gland, it’s obviously a hugh red flag right there, it’s not an image file or document file but an exe file

I threw it to pestudio and found that this file does 3 MITRE techniques

Then I searched the hash on VirusTotal, Sure enough that this file is malicious and these vendors labels it as Loki

So our investigation concluded here

What is the sending email address?

1
yanting@united.com.sg

What is the email address of the recipient?

1
admin@malware-traffic-analysis.net

What is the subject line of the email?

1
united scientific equipment

What date was the Email sent? Date format: MM/DD/YYYY

1
02/08/2021

What is the originating IP?

1
71.19.248.52

What country is the ip address from?

1
Canada

What is the name of the attachment when you unzip it? (with extension)

1
united scientific equipent.exe

What is the sha256 hash of the File?

1
9909753BFB0AC8AB165BAB3555233D03B01A9274A92E57C022F87CCBE51CA415

Is the email attachment malicious? Yes/No

1
Yes

Summary#

The phishing email was sent to admin which the sender was from Canada and doesn’t hide the actual mail, but the attachment that shipped with it is a malicious PE file labeled as LOKI, the infamous info-stealer some various also act as a ransomware