Analysis
-
max time kernel
58s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-11-2020 11:21
Static task
static1
Behavioral task
behavioral1
Sample
1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe
Resource
win10v20201028
General
-
Target
1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe
-
Size
783KB
-
MD5
fae8750fc4fbb827a87258ce330251a8
-
SHA1
1141f067de255d7442cfde1fc6991e20db57e4ba
-
SHA256
1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a
-
SHA512
251ecd8fda7a8cd4f5ca9c7714cbe4c5d9a12d329ae21e05757a8682b73abcc79b59d8f20105f3837eedd932c1b3473f6f58ef8fd1ae6ff3cb184692907192dc
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2108-10-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral2/memory/2108-11-0x0000000000401180-mapping.dmp family_isrstealer behavioral2/memory/2108-12-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/904-23-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
Nirsoft 1 IoCs
Processes:
resource yara_rule behavioral2/memory/904-23-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
Processes:
resource yara_rule behavioral2/memory/536-15-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/536-17-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/536-18-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/904-20-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/904-22-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/904-23-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exedescription pid process target process PID 4704 set thread context of 2108 4704 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 set thread context of 536 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 set thread context of 904 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exepid process 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exedescription pid process target process PID 4704 wrote to memory of 2108 4704 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 4704 wrote to memory of 2108 4704 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 4704 wrote to memory of 2108 4704 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 4704 wrote to memory of 2108 4704 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 4704 wrote to memory of 2108 4704 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 4704 wrote to memory of 2108 4704 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 4704 wrote to memory of 2108 4704 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 536 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 536 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 536 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 536 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 536 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 536 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 536 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 536 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 904 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 904 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 904 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 904 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 904 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 904 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 904 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe PID 2108 wrote to memory of 904 2108 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe"C:\Users\Admin\AppData\Local\Temp\1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe/scomma "C:\Users\Admin\AppData\Local\Temp\J6CxHUSEd9.ini"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe/scomma "C:\Users\Admin\AppData\Local\Temp\AvI4Fh9LK6.ini"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\J6CxHUSEd9.iniMD5
d1ea279fb5559c020a1b4137dc4de237
SHA1db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3
-
memory/536-15-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/536-18-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/536-17-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/536-16-0x00000000004512E0-mapping.dmp
-
memory/904-23-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/904-22-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/904-20-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/904-21-0x000000000041C410-mapping.dmp
-
memory/2108-11-0x0000000000401180-mapping.dmp
-
memory/2108-12-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2108-10-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/4704-0-0x0000000073FA0000-0x000000007468E000-memory.dmpFilesize
6.9MB
-
memory/4704-9-0x0000000007BC0000-0x0000000007BC1000-memory.dmpFilesize
4KB
-
memory/4704-8-0x0000000007510000-0x00000000075B7000-memory.dmpFilesize
668KB
-
memory/4704-7-0x0000000007230000-0x0000000007244000-memory.dmpFilesize
80KB
-
memory/4704-6-0x00000000075F0000-0x00000000075F1000-memory.dmpFilesize
4KB
-
memory/4704-5-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/4704-4-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/4704-3-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/4704-1-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB