bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a

General

Target
bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe
Size 1.6MB
Sample231214-arftdsacgl
SHA256 bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a
MD5 d52b898c05c2dec43eb121a9c87b668c
SHA1 1b58f96631ebaee4721feaf8f0fc6b29ac1de49f
SHA512 bfa4e5f83da33ddf24bba21067b857cfc1448c73a1ecdfd55b5efd3afffc743dae194d0fe6df98560ff4d4c360d02952508b8993c036bbc3741c2f86b43ad756
SSDEEP 49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uonTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery persistence spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	ipinfo.io
25	ipinfo.io

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe
File opened for modification	C:\Windows\System32\GroupPolicy	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3924	1280	WerFault.exe	87

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4888	schtasks.exe
4624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1280	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe
1280	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 4888	1280	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe	89
PID 1280 wrote to memory of 4888	1280	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe	89
PID 1280 wrote to memory of 4888	1280	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe	89
PID 1280 wrote to memory of 4624	1280	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe	93
PID 1280 wrote to memory of 4624	1280	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe	93
PID 1280 wrote to memory of 4624	1280	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe	93

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe

C:\Users\Admin\AppData\Local\Temp\bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe
"C:\Users\Admin\AppData\Local\Temp\bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a.exe"
1⤵
- Drops startup file
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1280
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:4888
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:4624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 1312
  2⤵
  - Program crash
  PID:3924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1280 -ip 1280
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OfficeTrackerNMP131.exe

Path C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
Size 1.6MB
SHA256 bc92f98868dd6ee650b287f2ad156c8468d50c3849d7c5ca2aa9fd0b83e5f92a
MD5 d52b898c05c2dec43eb121a9c87b668c
SHA1 1b58f96631ebaee4721feaf8f0fc6b29ac1de49f
SHA512 bfa4e5f83da33ddf24bba21067b857cfc1448c73a1ecdfd55b5efd3afffc743dae194d0fe6df98560ff4d4c360d02952508b8993c036bbc3741c2f86b43ad756
SSDEEP 49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uonTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u
MD5 SHA1 SHA512 SSDEEP

Submit Download

information.txt

Path C:\Users\Admin\AppData\Local\Temp\grandUIAvU4DQoWX1Oy16\information.txt
Size 3KB
SHA256 aa3b6c2aa5d12ae1536663a847c60516fdf33a745cd086b50c9b93760f7809d4
MD5 1f4d00726db18afe1b2ce69349dc48c8
SHA1 d7af88a610bf2fe6cdf4c195c58c3b7182221e27
SHA512 2440eb604a38669d7e23d5465d121db700583510a49fae9b9e9223497dbc5bc5448e599b1d76acf4c38da257a2ba4f522f4b160db3f5730abe4fb2f27305ae2e
MD5 SHA1 SHA512

Submit Download

QdX9ITDLyCRBWeb Data

Path C:\Users\Admin\AppData\Local\Temp\posterBoxvU4DQoWX1Oy16\QdX9ITDLyCRBWeb Data
Size 92KB
SHA256 415b5d95ff3e636716deaa385106694fcc257f82be4fe831fdaed420bba50cf2
MD5 15b15858232eb73939154fa51070f7d9
SHA1 c5d442be8afd48c12f3e10324d74c274ebad25d8
SHA512 8477c2a94ecbecff9d79d3f73713d568ab29260cd51397f54939629531aa84eeaaffc742bef744da071718b597b15e8870c547cf1dfeb122686bb9e59a7dfd86
SSDEEP 192:dtxbavrNdl9bH9CxbGsTjOnaVh6is6PJVum3:/Ravrbl9D9pnaVh6lcJVum3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZunTSaNJLBVfWeb Data

Path C:\Users\Admin\AppData\Local\Temp\posterBoxvU4DQoWX1Oy16\ZunTSaNJLBVfWeb Data
Size 116KB
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
SSDEEP 192:CTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWtETVumQ6W:UPWJ6a9xpnQLqtzKWJnsVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads