fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7

General

Target
fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7.exe
Size 1.6MB
Sample231214-mlkllsedc4
SHA256 fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7
MD5 db995e4e62657669b26416255830e024
SHA1 7a868f209d70ada868b94375a4587c5dd166ab4e
SHA512 c4ab12b257335b1f59c83e2f894535b6d1733dbd884f005b4b9ce824b80e085b838d0ac7b1700122656a4cd1d8bd5d398a22cbcccc8e2a155ff2106e88f63ba4
SSDEEP 49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7.exe
Key opened	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7.exe
Key opened	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ipinfo.io
4	ipinfo.io

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4044	4604	WerFault.exe	70

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4604	fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7.exe
4604	fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7.exe

C:\Users\Admin\AppData\Local\Temp\fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7.exe
"C:\Users\Admin\AppData\Local\Temp\fa3ca7fde49fbb6ebece7cd7eb61a787d256e08237e7544210b94a49311db9e7.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:4604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 1328
  2⤵
  - Program crash
  PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

information.txt

Path C:\Users\Admin\AppData\Local\Temp\grandUIA4r4aqdXIkacTt\information.txt
Size 3KB
SHA256 ceb9509478543027653722cf6202b04620247bb1e6f99109e3e1ceb14d4f3f7e
MD5 96080c5e5983424b3f1b0defec9001e0
SHA1 5b6e847902d58080597ac5939f349555077293be
SHA512 fa1675bbbfbd09bc57ffcb3841dda89c8fa458236a4d457ed48e78e792992de17dbe2b9623175a7b26978b2934693e1e685ac75c5d4929c7a78f9ed62d67fede
MD5 SHA1 SHA512

Submit Download

QdX9ITDLyCRBWeb Data

Path C:\Users\Admin\AppData\Local\Temp\posterBox4r4aqdXIkacTt\QdX9ITDLyCRBWeb Data
Size 92KB
SHA256 fdd37b06f981e619d6690edeaa17ba8d86c66cec9331632f3d9922bb2c6eabf5
MD5 90a4e3db168e5bdc6b5e562ce7f41a06
SHA1 2bf235c33b3395caefc1b9f1a280f83422f94d40
SHA512 e30f0a67bbdc6507ac5babaa5fe1e0db7cde6b62812f6365fe83293e5fbba3f62db43c80c635a43b3b0ffb2e08ac2faf79eff0d3bea8e2aaaca6c55fb0833c0b
SSDEEP 192:dtxbavrNdl9bH9CxbGsTjOnaVh6is6fJVum3:/Ravrbl9D9pnaVh6lMJVum3
MD5 SHA1 SHA512 SSDEEP