1c123f8cd194d826aaa48e97fa67b9db9faa1a5a1ada139f367d56904f6e0c04

General

Target

bce5589932044903237879f0e9e4840e.exe
Size

1.1MB
MD5

bce5589932044903237879f0e9e4840e
SHA1

2df044c89198fde64eb0b5a7c8182addf3486a2b
SHA256

1c123f8cd194d826aaa48e97fa67b9db9faa1a5a1ada139f367d56904f6e0c04
SHA512

51b487e2cca437e77bd45a19fee976e04ab3e64f5723c946757566d77961e3420a779d2c55af1b607a5c8930370288dadaa6862f00645bddf5c8a7c75bc47de3
SSDEEP

24576:qBZ3miL8zJa5e9AISUzOL9A5qU7wQmzXrbv4nlxlGYGeIVuj:I3miL8Me9AISUzCDIwQ0X4g5eIVu

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

bce5589932044903237879f0e9e4840e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\International\Geo\Nation	bce5589932044903237879f0e9e4840e.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

Email Collection

Processes:

bce5589932044903237879f0e9e4840e.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bce5589932044903237879f0e9e4840e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bce5589932044903237879f0e9e4840e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bce5589932044903237879f0e9e4840e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bce5589932044903237879f0e9e4840e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bce5589932044903237879f0e9e4840e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.ipify.org
6 api.ipify.org
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

bce5589932044903237879f0e9e4840e.exe

pid process

2172 bce5589932044903237879f0e9e4840e.exe

flow	ioc
5	api.ipify.org
6	api.ipify.org

pid	process
2172	bce5589932044903237879f0e9e4840e.exe

outlook_office_path 1 IoCs

Processes:

bce5589932044903237879f0e9e4840e.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bce5589932044903237879f0e9e4840e.exe

outlook_win_path 1 IoCs

Processes:

bce5589932044903237879f0e9e4840e.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bce5589932044903237879f0e9e4840e.exe