c9ea8cf5882a780b2f1a6dc11b191ee058eaaa63f33f749c5d9c3932e9db1cbb

General

Target
c9.exe
Size 436KB
Sample221010-rnfgwsccgk
SHA256 c9ea8cf5882a780b2f1a6dc11b191ee058eaaa63f33f749c5d9c3932e9db1cbb
MD5 fe1cfebd9eee316f8990bf8ab96b9010
SHA1 6d6ca8f61ba1a28ab3a5315d76263fc9539f555e
SHA512 5281d481cb1f834c196c0eecfe6b533ee6b827c82bec3a71de5c2a5a261f40ecfd4f303b90858d39e5fdfd332a2c4d4dd04384fffef0f58c9cc885ebabd833a3
SSDEEP 6144:WGmYL/2xry+oQrsOvKW+L8Mfk41p+awC11qfZIGbs5QpvQ:WhYj+O+oQrjvSfkoLwXZ3bs5Qpv
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection evasion spyware stealer

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1340	netsh.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c9.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c9.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c9.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	checkip.dyndns.org
24	ipinfo.io

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	c9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	c9.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\2CA005817435744CF7872712DC23E9F58F127ECD	c9.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\2CA005817435744CF7872712DC23E9F58F127ECD\Blob = 0300000001000000140000002ca005817435744cf7872712dc23e9f58f127ecd0200000001000000a40000001c00000044000000010000000000000000000000000000000100000043004e003d004f005600200056006500720069005300690067006e002000430041000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000001e0000004f005600200056006500720069005300690067006e0020004300410000002000000001000000e0020000308202dc308201c4a0030201020208598d458497b2243c300d06092a864886f70d01010b050030193117301506035504030c0e4f5620566572695369676e204341301e170d3231313030393134323033395a170d3235303131323134323033395a30193117301506035504030c0e4f5620566572695369676e20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ac637792e829dd8c0e25959f573dc83210e31ac6801ed4d2ab9c87c69b452b25d6652626b6bfbc8496623260492f3ecd44fa4b3481f406af82ac16703a50f42d4c6d60be9feeae92da584679a480f56efa78520bab89ed4a5653a2909f2ad8433ee2fca94d20bb6681bf94ce1d4be330621c0fc9571ba15163e2c60c4dde42066758ead296b580f2617b5b16c608827cf77653814b77f3a797f1a936fcbab058ca589f130248c9f5151e4327601781aba4bb62119386811b16f2579cc8e7472e00550e32121b30de01751b55297a973fc95fe1bfc2ba25d0ed3d4adb8f3728a0ca3f455de2c6116bcadf540d907f26d46a9f3cc1b54c4e5db524d1c18cdf26370203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101003e3eae9980c37ea19b678287b9a3c49673036f80ff8200006ea4a3c90d7f3ca6371c6b5812ab2322973cf52dfe65463892cc9d7f33f8f739feabadd619bb63fa59e987abbeee68529fa3446a4f09692c9f25ddce82b0dfe6d4521dc77a64f2dd2b675d2bdbbd389b23c1e4f1f3d729783c67bbaa040f9718bf8774fe3ea0cce23f07ec20d5ad08d920568ac63c74d120bcba52448ba77f2bccbddc2a813da84968365c27ddcaae8a47952a66ebc918c9b288db02c5a267ad6afcdb2a84c25a312910a489cfea9b07f9281d9394dfa9bea69c1a45f500f9e3c21d611d08e45b0ca4da2ee5fc825f8183dc18f2c4621c33b357d962c866d070371298b0d339502f	c9.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\2CA005817435744CF7872712DC23E9F58F127ECD\Blob = 140000000100000014000000fb6b80799fad13871c9c4f3bee21daf67808475e0b000000010000001e0000004f005600200056006500720069005300690067006e0020004300410000000200000001000000a40000001c00000044000000010000000000000000000000000000000100000043004e003d004f005600200056006500720069005300690067006e002000430041000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000300000001000000140000002ca005817435744cf7872712dc23e9f58f127ecd2000000001000000e0020000308202dc308201c4a0030201020208598d458497b2243c300d06092a864886f70d01010b050030193117301506035504030c0e4f5620566572695369676e204341301e170d3231313030393134323033395a170d3235303131323134323033395a30193117301506035504030c0e4f5620566572695369676e20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ac637792e829dd8c0e25959f573dc83210e31ac6801ed4d2ab9c87c69b452b25d6652626b6bfbc8496623260492f3ecd44fa4b3481f406af82ac16703a50f42d4c6d60be9feeae92da584679a480f56efa78520bab89ed4a5653a2909f2ad8433ee2fca94d20bb6681bf94ce1d4be330621c0fc9571ba15163e2c60c4dde42066758ead296b580f2617b5b16c608827cf77653814b77f3a797f1a936fcbab058ca589f130248c9f5151e4327601781aba4bb62119386811b16f2579cc8e7472e00550e32121b30de01751b55297a973fc95fe1bfc2ba25d0ed3d4adb8f3728a0ca3f455de2c6116bcadf540d907f26d46a9f3cc1b54c4e5db524d1c18cdf26370203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101003e3eae9980c37ea19b678287b9a3c49673036f80ff8200006ea4a3c90d7f3ca6371c6b5812ab2322973cf52dfe65463892cc9d7f33f8f739feabadd619bb63fa59e987abbeee68529fa3446a4f09692c9f25ddce82b0dfe6d4521dc77a64f2dd2b675d2bdbbd389b23c1e4f1f3d729783c67bbaa040f9718bf8774fe3ea0cce23f07ec20d5ad08d920568ac63c74d120bcba52448ba77f2bccbddc2a813da84968365c27ddcaae8a47952a66ebc918c9b288db02c5a267ad6afcdb2a84c25a312910a489cfea9b07f9281d9394dfa9bea69c1a45f500f9e3c21d611d08e45b0ca4da2ee5fc825f8183dc18f2c4621c33b357d962c866d070371298b0d339502f	c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2CA005817435744CF7872712DC23E9F58F127ECD	c9.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2CA005817435744CF7872712DC23E9F58F127ECD\Blob = 0300000001000000140000002ca005817435744cf7872712dc23e9f58f127ecd0200000001000000a40000001c00000044000000010000000000000000000000000000000100000043004e003d004f005600200056006500720069005300690067006e002000430041000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000001e0000004f005600200056006500720069005300690067006e0020004300410000002000000001000000e0020000308202dc308201c4a0030201020208598d458497b2243c300d06092a864886f70d01010b050030193117301506035504030c0e4f5620566572695369676e204341301e170d3231313030393134323033395a170d3235303131323134323033395a30193117301506035504030c0e4f5620566572695369676e20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ac637792e829dd8c0e25959f573dc83210e31ac6801ed4d2ab9c87c69b452b25d6652626b6bfbc8496623260492f3ecd44fa4b3481f406af82ac16703a50f42d4c6d60be9feeae92da584679a480f56efa78520bab89ed4a5653a2909f2ad8433ee2fca94d20bb6681bf94ce1d4be330621c0fc9571ba15163e2c60c4dde42066758ead296b580f2617b5b16c608827cf77653814b77f3a797f1a936fcbab058ca589f130248c9f5151e4327601781aba4bb62119386811b16f2579cc8e7472e00550e32121b30de01751b55297a973fc95fe1bfc2ba25d0ed3d4adb8f3728a0ca3f455de2c6116bcadf540d907f26d46a9f3cc1b54c4e5db524d1c18cdf26370203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101003e3eae9980c37ea19b678287b9a3c49673036f80ff8200006ea4a3c90d7f3ca6371c6b5812ab2322973cf52dfe65463892cc9d7f33f8f739feabadd619bb63fa59e987abbeee68529fa3446a4f09692c9f25ddce82b0dfe6d4521dc77a64f2dd2b675d2bdbbd389b23c1e4f1f3d729783c67bbaa040f9718bf8774fe3ea0cce23f07ec20d5ad08d920568ac63c74d120bcba52448ba77f2bccbddc2a813da84968365c27ddcaae8a47952a66ebc918c9b288db02c5a267ad6afcdb2a84c25a312910a489cfea9b07f9281d9394dfa9bea69c1a45f500f9e3c21d611d08e45b0ca4da2ee5fc825f8183dc18f2c4621c33b357d962c866d070371298b0d339502f	c9.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4152	c9.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe
4152	c9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4152	c9.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 1340	4152	c9.exe	88
PID 4152 wrote to memory of 1340	4152	c9.exe	88

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c9.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c9.exe

C:\Users\Admin\AppData\Local\Temp\c9.exe
"C:\Users\Admin\AppData\Local\Temp\c9.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4152
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" firewall add allowedprogram C:\Users\Admin\AppData\Local\Temp\c9.exe SystemUpdate ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:1340