e310cc6f7761ca6cb46dd3684a4397a0035d9818b8210fc33f2cf23e17a12df2

General

Target

894fdbe41d7fa24ddb08f16ace51561a.exe
Size

1.6MB
MD5

894fdbe41d7fa24ddb08f16ace51561a
SHA1

2b2637864e8fa547760d1b09292976e5b6dde6d5
SHA256

e310cc6f7761ca6cb46dd3684a4397a0035d9818b8210fc33f2cf23e17a12df2
SHA512

94bb0f2e94b65e235590ae52425dc50a605870343b0241b86b33e87945128d773fe4459202eb029ed887979dd77ea1e7389a2737da4e863c0e10390de2c8b023
SSDEEP

49152:qWg8wUmZOzqiavjDUJO/WH89ctcO0ljbbQnIQGotBKqy8TJCHEGU42sn6:ZiUmZOzqiavjDUM/WH89y8bboGO

Score

7^/10

collection discovery persistence spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	894fdbe41d7fa24ddb08f16ace51561a.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	894fdbe41d7fa24ddb08f16ace51561a.exe
Key opened	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	894fdbe41d7fa24ddb08f16ace51561a.exe
Key opened	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	894fdbe41d7fa24ddb08f16ace51561a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	894fdbe41d7fa24ddb08f16ace51561a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ipinfo.io
24	ipinfo.io

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	894fdbe41d7fa24ddb08f16ace51561a.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	894fdbe41d7fa24ddb08f16ace51561a.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	894fdbe41d7fa24ddb08f16ace51561a.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	894fdbe41d7fa24ddb08f16ace51561a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	4692	WerFault.exe	81

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	894fdbe41d7fa24ddb08f16ace51561a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	894fdbe41d7fa24ddb08f16ace51561a.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1648	schtasks.exe
1496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4692	894fdbe41d7fa24ddb08f16ace51561a.exe
4692	894fdbe41d7fa24ddb08f16ace51561a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3032	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 1648	4692	894fdbe41d7fa24ddb08f16ace51561a.exe	86
PID 4692 wrote to memory of 1648	4692	894fdbe41d7fa24ddb08f16ace51561a.exe	86
PID 4692 wrote to memory of 1648	4692	894fdbe41d7fa24ddb08f16ace51561a.exe	86
PID 4692 wrote to memory of 1496	4692	894fdbe41d7fa24ddb08f16ace51561a.exe	90
PID 4692 wrote to memory of 1496	4692	894fdbe41d7fa24ddb08f16ace51561a.exe	90
PID 4692 wrote to memory of 1496	4692	894fdbe41d7fa24ddb08f16ace51561a.exe	90

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	894fdbe41d7fa24ddb08f16ace51561a.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	894fdbe41d7fa24ddb08f16ace51561a.exe

C:\Users\Admin\AppData\Local\Temp\894fdbe41d7fa24ddb08f16ace51561a.exe
"C:\Users\Admin\AppData\Local\Temp\894fdbe41d7fa24ddb08f16ace51561a.exe"
1⤵
- Drops startup file
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4692
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:1648
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:1496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 1688
  2⤵
  - Program crash
  PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4692 -ip 4692
1⤵
PID:608

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe

Filesize
1.6MB

MD5
894fdbe41d7fa24ddb08f16ace51561a

SHA1
2b2637864e8fa547760d1b09292976e5b6dde6d5

SHA256
e310cc6f7761ca6cb46dd3684a4397a0035d9818b8210fc33f2cf23e17a12df2

SHA512
94bb0f2e94b65e235590ae52425dc50a605870343b0241b86b33e87945128d773fe4459202eb029ed887979dd77ea1e7389a2737da4e863c0e10390de2c8b023

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
ed5a58b4fccb056d91a1cf0e73dc2998

SHA1
321ed46dc2a7ae134dcaec5d00f4028ee4cf5a0d

SHA256
13fcdc8236ad1bc3c75d373d7104762ecdeb9a000c9ec14f6ade5af80684c2e9

SHA512
d394036ea9bcdbdfd0b1601392644afd4ff2d0d9c7cac8f8f320c2a2653ce98817103713ce01f75b04fae02ede930030439a62988731d0fa3ca27ba28cca433a

Download Submit
C:\Users\Admin\AppData\Local\Temp\grandUIACopnlDFyVX8Jg\information.txt

Filesize
3KB

MD5
b96cb7bd395a6d80dce1cf11028da492

SHA1
d2b38ce1168a8a17ec0ace59a98202ea0428e1f5

SHA256
45633baf8afe417c1a829909c845ea31d6c1211dc59d139671a000efba4a08b3

SHA512
0b06dbfb1999463f67859413c9f3bca7bffcf694e2b8403299822b7451cdaf2847f4fe32d6a4fc9aaae322ef49efbb7db2917323c859f1e9e7e63742a9b0b7b6

Download Submit
memory/3032-116-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

Filesize
4KB

Download
memory/3032-118-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

Filesize
4KB

Download
memory/3032-109-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

Filesize
4KB

Download
memory/3032-110-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

Filesize
4KB

Download
memory/3032-111-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

Filesize
4KB

Download
memory/3032-112-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

Filesize
4KB

Download
memory/3032-113-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

Filesize
4KB

Download
memory/3032-114-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

Filesize
4KB

Download
memory/3032-115-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

Filesize
4KB

Download
memory/3032-92-0x0000020699940000-0x0000020699950000-memory.dmp

Filesize
64KB

Download
memory/3032-117-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

Filesize
4KB

Download
memory/3032-108-0x00000206A1EA0000-0x00000206A1EA1000-memory.dmp

Filesize
4KB

Download
memory/3032-119-0x00000206A1B00000-0x00000206A1B01000-memory.dmp

Filesize
4KB

Download
memory/3032-120-0x00000206A1AF0000-0x00000206A1AF1000-memory.dmp

Filesize
4KB

Download
memory/3032-122-0x00000206A1B00000-0x00000206A1B01000-memory.dmp

Filesize
4KB

Download
memory/3032-125-0x00000206A1AF0000-0x00000206A1AF1000-memory.dmp

Filesize
4KB

Download
memory/3032-128-0x00000206991E0000-0x00000206991E1000-memory.dmp

Filesize
4KB

Download
memory/3032-76-0x0000020699840000-0x0000020699850000-memory.dmp

Filesize
64KB

Download
memory/3032-140-0x00000206A1C20000-0x00000206A1C21000-memory.dmp

Filesize
4KB

Download
memory/3032-142-0x00000206A1C30000-0x00000206A1C31000-memory.dmp

Filesize
4KB

Download
memory/3032-143-0x00000206A1C30000-0x00000206A1C31000-memory.dmp

Filesize
4KB

Download
memory/3032-144-0x00000206A1D40000-0x00000206A1D41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads