0472673e4549301954c5ee96c2c3b7c1fef805a0e8ce7c6696e78d0acf07cb93

General

Target
0472673e4549301954c5ee96c2c3b7c1fef805a0e8ce7c6696e78d0acf07cb93.exe
Size 1.6MB
Sample231214-mpk2jsedd6
SHA256 0472673e4549301954c5ee96c2c3b7c1fef805a0e8ce7c6696e78d0acf07cb93
MD5 1b94ebde2b4942cb497e589c1aeb0891
SHA1 01a51b1e3fc70949feb3718b664035ec74fe64d5
SHA512 59ce815f1f23746a1325699b8eb1cab41ea5e6067ca2a9d55101b19c3e57316994e99734f1072e365f7352929683e7ccc67ea84947073282c030c8e9f0d75524
SSDEEP 49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0472673e4549301954c5ee96c2c3b7c1fef805a0e8ce7c6696e78d0acf07cb93.exe
Key opened	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0472673e4549301954c5ee96c2c3b7c1fef805a0e8ce7c6696e78d0acf07cb93.exe
Key opened	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0472673e4549301954c5ee96c2c3b7c1fef805a0e8ce7c6696e78d0acf07cb93.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ipinfo.io
3	ipinfo.io

Program crash 1 IoCs

pid	pid_target	Process	procid_target
988	4972	WerFault.exe	70

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0472673e4549301954c5ee96c2c3b7c1fef805a0e8ce7c6696e78d0acf07cb93.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0472673e4549301954c5ee96c2c3b7c1fef805a0e8ce7c6696e78d0acf07cb93.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4972	0472673e4549301954c5ee96c2c3b7c1fef805a0e8ce7c6696e78d0acf07cb93.exe
4972	0472673e4549301954c5ee96c2c3b7c1fef805a0e8ce7c6696e78d0acf07cb93.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0472673e4549301954c5ee96c2c3b7c1fef805a0e8ce7c6696e78d0acf07cb93.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0472673e4549301954c5ee96c2c3b7c1fef805a0e8ce7c6696e78d0acf07cb93.exe

C:\Users\Admin\AppData\Local\Temp\0472673e4549301954c5ee96c2c3b7c1fef805a0e8ce7c6696e78d0acf07cb93.exe
"C:\Users\Admin\AppData\Local\Temp\0472673e4549301954c5ee96c2c3b7c1fef805a0e8ce7c6696e78d0acf07cb93.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 1276
  2⤵
  - Program crash
  PID:988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

information.txt

Path C:\Users\Admin\AppData\Local\Temp\grandUIAWbU6dz1HZwbCt\information.txt
Size 3KB
SHA256 d5c66b38d44a4ffa2d3f64813395337f0fad5c299bbd688aa1f2223b66307120
MD5 b2eb2651481b349804c66d18ea0fcd48
SHA1 35335d3824e3bcdaf8399329a7d3eb20395e5ea0
SHA512 a59d3d979acc3aae3172a08bef73e60100cdf22bbc6ca59f62276b9cee682b946ba958d64e25ea8a8901b4383318b01e71cd5fe37d1badb57f9456dd50d86cce
MD5 SHA1 SHA512

Submit Download

QdX9ITDLyCRBWeb Data

Path C:\Users\Admin\AppData\Local\Temp\posterBoxWbU6dz1HZwbCt\QdX9ITDLyCRBWeb Data
Size 92KB
SHA256 1976c8cf1ab2fd32680f25be2b7b5d7c8ae5780948024cafbbdde28e25cdf31c
MD5 843933002e97a0ed13a5842ff69162e7
SHA1 78c28c8cf61ad98c9dce2855d27af25c2cb0254c
SHA512 77c82c3cc8dc7dccb2e59670b35539fda008ed002624125126558116697f07862cdce4489e581b6a2bf5e61bc5f0fd93d8adcd2370556dd053649c4ab2b0ebdb
SSDEEP 192:dtxbavrNdl9bH9CxbGsTjOnaVh6is67JVum3:/Ravrbl9D9pnaVh6lQJVum3
MD5 SHA1 SHA512 SSDEEP