d5c5b23355fd928c660358f5ca0ae439.exe

General
Target

d5c5b23355fd928c660358f5ca0ae439.exe

Filesize

312KB

Completed

01-07-2020 16:10

Score
7 /10
MD5

d5c5b23355fd928c660358f5ca0ae439

SHA1

87508a996eac3dae3ce463c7de2c3ee3b4812cc2

SHA256

178cf2e50182606e000719ee8b7caa9c620950155542d10de6dd7eb5a2a34d01

Malware Config
Signatures 5

Filter: none

Collection
Credential Access
Discovery
  • Suspicious behavior: EnumeratesProcesses
    d5c5b23355fd928c660358f5ca0ae439.exe

    Reported IOCs

    pidprocess
    832d5c5b23355fd928c660358f5ca0ae439.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Checks for installed software on the system
    d5c5b23355fd928c660358f5ca0ae439.exe

    Tags

    TTPs

    Query Registry

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstalld5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key enumerated\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstalld5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key opened\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstalld5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayNamed5c5b23355fd928c660358f5ca0ae439.exe
  • Loads dropped DLL
    d5c5b23355fd928c660358f5ca0ae439.exe

    Reported IOCs

    pidprocess
    832d5c5b23355fd928c660358f5ca0ae439.exe
  • Suspicious use of AdjustPrivilegeToken
    d5c5b23355fd928c660358f5ca0ae439.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege832d5c5b23355fd928c660358f5ca0ae439.exe
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\d5c5b23355fd928c660358f5ca0ae439.exe
    "C:\Users\Admin\AppData\Local\Temp\d5c5b23355fd928c660358f5ca0ae439.exe"
    Suspicious behavior: EnumeratesProcesses
    Checks for installed software on the system
    Loads dropped DLL
    Suspicious use of AdjustPrivilegeToken
    PID:832
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • \Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll