1ac5871f2a0cb7448f6f7d6cbf6602954589bf34940e899ba284730bb9623b2e

General

Target
8ae79097a85e4cafd748d184024e52a7.exe
Size 598KB
Sample220403-rc9atsbed2
SHA256 1ac5871f2a0cb7448f6f7d6cbf6602954589bf34940e899ba284730bb9623b2e
MD5 8ae79097a85e4cafd748d184024e52a7
SHA1 019b8452864f566851af1018cce15cc7e7000bc2
SHA512 f015c9edfa6cca10df0d5a8b4a26ee8287acd82e80bfdebaeddb3bc731587c1b19685878f97fc376370b2ae579858a5e9caa2a2fda5d7e7f075b16b69f3d5fd8
MD5 SHA1 SHA512

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

Email Collection

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8ae79097a85e4cafd748d184024e52a7.exe
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8ae79097a85e4cafd748d184024e52a7.exe
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8ae79097a85e4cafd748d184024e52a7.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	8ae79097a85e4cafd748d184024e52a7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	8ae79097a85e4cafd748d184024e52a7.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1892	8ae79097a85e4cafd748d184024e52a7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1892	8ae79097a85e4cafd748d184024e52a7.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 4548	1892	8ae79097a85e4cafd748d184024e52a7.exe	79
PID 1892 wrote to memory of 4548	1892	8ae79097a85e4cafd748d184024e52a7.exe	79
PID 4548 wrote to memory of 4680	4548	cmd.exe	81
PID 4548 wrote to memory of 4680	4548	cmd.exe	81
PID 4548 wrote to memory of 5024	4548	cmd.exe	83
PID 4548 wrote to memory of 5024	4548	cmd.exe	83
PID 4548 wrote to memory of 3460	4548	cmd.exe	82
PID 4548 wrote to memory of 3460	4548	cmd.exe	82
PID 1892 wrote to memory of 3796	1892	8ae79097a85e4cafd748d184024e52a7.exe	85
PID 1892 wrote to memory of 3796	1892	8ae79097a85e4cafd748d184024e52a7.exe	85
PID 3796 wrote to memory of 4832	3796	cmd.exe	86
PID 3796 wrote to memory of 4832	3796	cmd.exe	86
PID 3796 wrote to memory of 1688	3796	cmd.exe	88
PID 3796 wrote to memory of 1688	3796	cmd.exe	88
PID 3796 wrote to memory of 3672	3796	cmd.exe	87
PID 3796 wrote to memory of 3672	3796	cmd.exe	87

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8ae79097a85e4cafd748d184024e52a7.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8ae79097a85e4cafd748d184024e52a7.exe