44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe
Size

914KB
MD5

e450ca946d4bf6173ebe3f00c3d08d81
SHA1

3653f8f0231dfad94100f3f3ae3fbae0c3b0d208
SHA256

44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff
SHA512

9c884eb29f2d084973a7cc760d3c4e41f3601ef9b22081e083e371301d5b6b22d8e52cacaf6e4a2fd7466d5819876a69921326fa59a24ff75ed85297cda88fba
SSDEEP

24576:Wi1kZ9SO9RfhEQ9A1rQmbGSbcG4SuyKs+P/3aC:rkZ9SO9RfpmOSbcGdJKsyaC

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation	44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

Processes:

44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe

pid process

1688 44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

pid	process
1688	44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe

outlook_office_path 1 IoCs

Processes:

44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe

outlook_win_path 1 IoCs

Processes:

44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe

C:\Users\Admin\AppData\Local\Temp\44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe
"C:\Users\Admin\AppData\Local\Temp\44e715e3d9b5434c099452cc2cd991b1f02d4aba25114341a37dc142efd089ff.exe"
1⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:1688

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads