Incident Summary

A user on Sophia (172[.]16[.]17[.]112) got a phishing email from support[@]jsonbank[.]com with Bank Details[.]bin[.]zip attached. They extracted it and ran Bank Details[.]exe, a .NET infostealer (VT: Trojan.MSIL/Loki). It read Outlook profile data from the registry, checked its public IP through api[.]ipify[.]org, resolved mail[.]poskirantextile[.]com to 109[.]232[.]217[.]97 (Turkey), and sent the stolen data out over SMTP 587. The EDR detected it but didn’t block it. Endpoint contained.

Attack Chain

1. Phishing email delivers Bank Details[.]bin[.]zip
2. User extracts it to Downloads\Bank Details[.]bin\
3. User runs Bank Details[.]exe
4. Malware reads registry keys under Outlook\Profiles to harvest stored mail account data
5. Public IP check to api[.]ipify[.]org
6. DNS lookup mail[.]poskirantextile[.]com → 109[.]232[.]217[.]97
7. SMTP connection to 109[.]232[.]217[.]97:587 fires SOC208

Key Findings

• Port 587 counts as unauthorised here because Sophia is a client workstation, not a mail server. A user process talking SMTP is the usual exfil pattern for .NET stealers.
• The OS logs in Log Management show Bank Details[.]exe reading several registry paths under Outlook\Profiles. That’s the collection step and the reason it then talks to a mail server.
• The ipify lookup is the stealer recording the victim’s public IP to send along with the stolen data.
• Calling the archive and folder .bin disguises the executable.
• The Any.run connections match what showed up in the endpoint network logs, which confirms it ran on the host.
• The EDR only detected it, so assume the stolen data got out.

MITRE ATT&CK

ID	Tactic	Technique
T1566.001	Initial Access	Spearphishing Attachment
T1204.002	Execution	Malicious File
T1036	Defense Evasion	Masquerading
T1016	Discovery	System Network Configuration Discovery
T1114	Collection	Email Collection
T1071.003	Command and Control	Mail Protocols
T1041	Exfiltration	Exfiltration Over C2 Channel

Analyst note: The platform maps the exfil to T1041 because the malware only talks to one external server. For stealers that send over SMTP only, with no commands coming back, T1048.003 (Exfiltration Over Unencrypted Non-C2 Protocol) is probably more accurate. I submitted the platform’s mapping and I’m recording mine here.

IOCs

Type	Value
Sender	support[@]jsonbank[.]com
SHA256 (Bank Details.bin.zip)	822EA619386B77513ECD2A0D5EF905DA10DFF34675CD5DCDE316660AF6973902
SHA256 (Bank Details.exe)	6396042BC3217FC7B2F7025D05790336A0CD24AB3F67238E4FCFAB2873825273
Domain	mail[.]poskirantextile[.]com
Domain	api[.]ipify[.]org (legit service, abused)
IP	109[.]232[.]217[.]97:587
Registry	HKCU…\Outlook\Profiles* (read)

Containment and Recommendations

• Endpoint contained
• Purge the email from every mailbox and block jsonbank[.]com
• Block the IP and the mail domain
• Reset every credential the user has, especially the Outlook and mail accounts
• Hunt across the estate for both hashes, connections to the IP, and other processes reading Outlook\Profiles
• Block outbound 587 from endpoints unless it’s going to approved mail servers
• Reimage the host

Verdict

True Positive. Infostealer harvested Outlook profile data and exfiltrated it over SMTP. Contained and escalated.

What I Got Wrong

Playbook score: 10 (73%). I got three questions wrong, and they’re worth more to me than the ones I got right.

1. Storage-based collection: I answered Data from Local System. The answer was Email Collection.
I went with the network side and Any.run and never opened the OS logs in Log Management. If I had, I’d have seen the malware reading Outlook\Profiles keys straight away. I’d also written off the platform’s T1114 tag as generic when it was backed by evidence the whole time.
Lesson: once you know the malicious process, check what it touched on the host (registry, files, processes), not just where it connected. And when the platform tags a technique, go and find the evidence for it before you dismiss it.

2. Interaction-based collection: I answered Input Capture. The answer was None.
I took that from the Any.run report, which flagged keylogging. But a sandbox shows what a sample can do when it’s detonated, not what it did in this environment. Lots of stealers have keylogging built in and switched off in a given build’s config.
Lesson: the sandbox tells you what to hunt for, and your own logs decide the answer. If there’s no keyboard hook, clipboard access or keylog file in the endpoint telemetry, it’s None.

3. Exfiltration: I answered Exfiltration Over Alternative Protocol. The answer was Exfiltration Over C2 Channel.
This one’s arguable. The platform treats the only external server as the C2. I think T1048.003 fits SMTP stealers better, and I’ve noted that above. Still a miss on the platform’s framing, though.
Lesson: know how the platform frames things. Submit their mapping and record your own in the notes.

Analysis Reports

• 🧪 Any.run: Bank Details.exe
• 🔬 VirusTotal: Bank Details.exe
• 🔬 VirusTotal: Bank Details.bin.zip
• 🌐 AbuseIPDB: 109.232.217.97