isrstealer | 45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a

Analysis

max time kernel
150s
max time network
117s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe
Size

467KB
MD5

6ec3bac962c40daf8da977aae6b0a180
SHA1

e2b0a2d2869669f0e57ba6a81754fb4f6956d90d
SHA256

45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a
SHA512

4288187446e2eb074ddddc84f7f8f3e0335e8bf9bc06d17af460e9283d225b36badac9ceee80ef6f5572d24c726413546ad7034e53d70fe14a340a006fb9098f
SSDEEP

12288:h5SQ/ZG0hAcaLqSUV4Euoruh+6MGEFdXLmYb:31/ILVUJ5rgDMTdfb

Score

10^/10

isrstealer collection persistence spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1056-140-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral1/memory/1056-148-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral1/memory/1056-145-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral1/memory/1056-163-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral1/memory/1056-183-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral1/memory/1056-184-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1604-181-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Nirsoft 1 IoCs

resource	yara_rule
behavioral1/memory/1604-181-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

Executes dropped EXE 6 IoCs

pid	Process
2020	FileName.scr
1052	FileName.scr
1992	FileName.scr
1056	FileName.scr
1516	FileName.scr
1604	FileName.scr

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1708-58-0x0000000000400000-0x000000000056A000-memory.dmp	upx
behavioral1/memory/628-73-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/628-75-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/628-76-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/628-81-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1100-84-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/628-83-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1100-90-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1100-86-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1708-95-0x0000000000400000-0x000000000056A000-memory.dmp	upx
behavioral1/memory/1100-96-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1100-94-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/628-100-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1100-101-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/files/0x00060000000144ba-103.dat	upx
behavioral1/files/0x00060000000144ba-104.dat	upx
behavioral1/files/0x00060000000144ba-106.dat	upx
behavioral1/files/0x00060000000144ba-108.dat	upx
behavioral1/files/0x00060000000144ba-107.dat	upx
behavioral1/memory/1100-111-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/files/0x00060000000144ba-110.dat	upx
behavioral1/memory/2020-114-0x0000000000400000-0x000000000056A000-memory.dmp	upx
behavioral1/files/0x00060000000144ba-115.dat	upx
behavioral1/files/0x00060000000144ba-122.dat	upx
behavioral1/files/0x00060000000144ba-133.dat	upx
behavioral1/memory/1992-149-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1992-153-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2020-151-0x0000000000400000-0x000000000056A000-memory.dmp	upx
behavioral1/files/0x00060000000144ba-150.dat	upx
behavioral1/memory/1052-147-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1516-156-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/files/0x00060000000144ba-158.dat	upx
behavioral1/memory/1516-164-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1516-171-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/files/0x00060000000144ba-176.dat	upx
behavioral1/memory/1604-181-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1992-182-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Loads dropped DLL 5 IoCs

pid	Process
1100	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe
1100	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe
1100	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe
1100	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe
1100	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	FileName.scr

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Key Name = "C:\\Users\\Admin\\AppData\\Roaming\\FolderName\\FileName.scr"	reg.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 1708 set thread context of 628	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	27
PID 1708 set thread context of 1100	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	28
PID 2020 set thread context of 1052	2020	FileName.scr	31
PID 2020 set thread context of 1992	2020	FileName.scr	32
PID 2020 set thread context of 1056	2020	FileName.scr	33
PID 1056 set thread context of 1516	1056	FileName.scr	34
PID 1056 set thread context of 1604	1056	FileName.scr	42

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	FileName.scr
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FileName.scr
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FileName.scr

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr
Token: SeDebugPrivilege	1992	FileName.scr

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	DllHost.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe
628	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe
1100	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe
2020	FileName.scr
1052	FileName.scr
1992	FileName.scr
1056	FileName.scr

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 628	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	27
PID 1708 wrote to memory of 628	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	27
PID 1708 wrote to memory of 628	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	27
PID 1708 wrote to memory of 628	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	27
PID 1708 wrote to memory of 628	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	27
PID 1708 wrote to memory of 628	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	27
PID 1708 wrote to memory of 628	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	27
PID 1708 wrote to memory of 628	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	27
PID 1708 wrote to memory of 1100	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	28
PID 1708 wrote to memory of 1100	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	28
PID 1708 wrote to memory of 1100	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	28
PID 1708 wrote to memory of 1100	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	28
PID 1708 wrote to memory of 1100	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	28
PID 1708 wrote to memory of 1100	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	28
PID 1708 wrote to memory of 1100	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	28
PID 1708 wrote to memory of 1100	1708	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	28
PID 1100 wrote to memory of 2020	1100	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	30
PID 1100 wrote to memory of 2020	1100	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	30
PID 1100 wrote to memory of 2020	1100	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	30
PID 1100 wrote to memory of 2020	1100	45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe	30
PID 2020 wrote to memory of 1052	2020	FileName.scr	31
PID 2020 wrote to memory of 1052	2020	FileName.scr	31
PID 2020 wrote to memory of 1052	2020	FileName.scr	31
PID 2020 wrote to memory of 1052	2020	FileName.scr	31
PID 2020 wrote to memory of 1052	2020	FileName.scr	31
PID 2020 wrote to memory of 1052	2020	FileName.scr	31
PID 2020 wrote to memory of 1052	2020	FileName.scr	31
PID 2020 wrote to memory of 1052	2020	FileName.scr	31
PID 2020 wrote to memory of 1992	2020	FileName.scr	32
PID 2020 wrote to memory of 1992	2020	FileName.scr	32
PID 2020 wrote to memory of 1992	2020	FileName.scr	32
PID 2020 wrote to memory of 1992	2020	FileName.scr	32
PID 2020 wrote to memory of 1992	2020	FileName.scr	32
PID 2020 wrote to memory of 1992	2020	FileName.scr	32
PID 2020 wrote to memory of 1992	2020	FileName.scr	32
PID 2020 wrote to memory of 1992	2020	FileName.scr	32
PID 2020 wrote to memory of 1056	2020	FileName.scr	33
PID 2020 wrote to memory of 1056	2020	FileName.scr	33
PID 2020 wrote to memory of 1056	2020	FileName.scr	33
PID 2020 wrote to memory of 1056	2020	FileName.scr	33
PID 2020 wrote to memory of 1056	2020	FileName.scr	33
PID 2020 wrote to memory of 1056	2020	FileName.scr	33
PID 2020 wrote to memory of 1056	2020	FileName.scr	33
PID 2020 wrote to memory of 1056	2020	FileName.scr	33
PID 1056 wrote to memory of 1516	1056	FileName.scr	34
PID 1056 wrote to memory of 1516	1056	FileName.scr	34
PID 1056 wrote to memory of 1516	1056	FileName.scr	34
PID 1056 wrote to memory of 1516	1056	FileName.scr	34
PID 1056 wrote to memory of 1516	1056	FileName.scr	34
PID 1056 wrote to memory of 1516	1056	FileName.scr	34
PID 1056 wrote to memory of 1516	1056	FileName.scr	34
PID 1056 wrote to memory of 1516	1056	FileName.scr	34
PID 1056 wrote to memory of 1516	1056	FileName.scr	34
PID 1992 wrote to memory of 1552	1992	FileName.scr	35
PID 1992 wrote to memory of 1552	1992	FileName.scr	35
PID 1992 wrote to memory of 1552	1992	FileName.scr	35
PID 1992 wrote to memory of 1552	1992	FileName.scr	35
PID 1992 wrote to memory of 1552	1992	FileName.scr	35
PID 1992 wrote to memory of 1552	1992	FileName.scr	35
PID 1552 wrote to memory of 1696	1552	bitsadmin.exe	37
PID 1552 wrote to memory of 1696	1552	bitsadmin.exe	37
PID 1552 wrote to memory of 1696	1552	bitsadmin.exe	37
PID 1552 wrote to memory of 1696	1552	bitsadmin.exe	37
PID 1696 wrote to memory of 1780	1696	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe
"C:\Users\Admin\AppData\Local\Temp\45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe
  "C:\Users\Admin\AppData\Local\Temp\45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:628
- C:\Users\Admin\AppData\Local\Temp\45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe
  "C:\Users\Admin\AppData\Local\Temp\45e7ae0272b89cfd4437267c6062fd5ea9247c369a7b4a0465d3d1942a62659a.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr
    "C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr" /S
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr
      "C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1052
  - - C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr
      "C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1992
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1552
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\LETDL.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Key Name" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr" /f
        7⤵
        Adds Run key to start application
        
        PID:1780
  - - C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr
      "C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Modifies system certificate store
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1056
    - - C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\yAsKsVzlV4.ini"
        5⤵
        Executes dropped EXE
        
        PID:1516
    - - C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\hgudRUdEWt.ini"
        5⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:1604

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\KEOJ27.JPG

Filesize
20KB

MD5
ea4b13eb30530c4284db50729f206f03

SHA1
8593b257be7c4ee5c47a0fbc8af65d59ff158e8c

SHA256
699ccaf0e80b35d0d20b2df8abba52ee55134f7bd42d646a2c16083349351eae

SHA512
634c127b83637c93845e3b852d98725dad52cd32fc3da54619df1ce030f84dd7804c4c7478c3bf783903f0488803206d80f17090c09440ac437b9d4eb44b633e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LETDL.bat

Filesize
149B

MD5
f1ed151102970b8242e332bd800a9620

SHA1
5e69c22933d09594b96ca02dcecccd6439d09d04

SHA256
b2a71b35b8aa7236829344304b5c77c81200f053715ebcefb6fe4efae44e6841

SHA512
dd6cce101c8a501c3a7add12b2839751adaab544a6c4f900161f2d9333c50d0c95551b1ea3e6590370faf133bf68b8f0297a8ae93f646b9cfde3155cfa75f1b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\yAsKsVzlV4.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr

Filesize
467KB

MD5
5f7c6b64b69d84c89d87c69b259649b6

SHA1
e96b5cb3f299f1e373dfd8bffa2d493d7fce0aaf

SHA256
cec3a8e1c75e32aae6f9644b5c42928cc3aecb1b3a04b70bf0dffb9285ead9e1

SHA512
121bb6146dc39bdf240fb8080402fec384e854ac33dc458ebcb6cd6b8e8f3f1c471c83c9e24ea80fea264fca245f81d9f30a4aefad01f3343353e5d83eadb0ac

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr

Filesize
467KB

MD5
5f7c6b64b69d84c89d87c69b259649b6

SHA1
e96b5cb3f299f1e373dfd8bffa2d493d7fce0aaf

SHA256
cec3a8e1c75e32aae6f9644b5c42928cc3aecb1b3a04b70bf0dffb9285ead9e1

SHA512
121bb6146dc39bdf240fb8080402fec384e854ac33dc458ebcb6cd6b8e8f3f1c471c83c9e24ea80fea264fca245f81d9f30a4aefad01f3343353e5d83eadb0ac

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr

Filesize
467KB

MD5
5f7c6b64b69d84c89d87c69b259649b6

SHA1
e96b5cb3f299f1e373dfd8bffa2d493d7fce0aaf

SHA256
cec3a8e1c75e32aae6f9644b5c42928cc3aecb1b3a04b70bf0dffb9285ead9e1

SHA512
121bb6146dc39bdf240fb8080402fec384e854ac33dc458ebcb6cd6b8e8f3f1c471c83c9e24ea80fea264fca245f81d9f30a4aefad01f3343353e5d83eadb0ac

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr

Filesize
467KB

MD5
5f7c6b64b69d84c89d87c69b259649b6

SHA1
e96b5cb3f299f1e373dfd8bffa2d493d7fce0aaf

SHA256
cec3a8e1c75e32aae6f9644b5c42928cc3aecb1b3a04b70bf0dffb9285ead9e1

SHA512
121bb6146dc39bdf240fb8080402fec384e854ac33dc458ebcb6cd6b8e8f3f1c471c83c9e24ea80fea264fca245f81d9f30a4aefad01f3343353e5d83eadb0ac

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr

Filesize
467KB

MD5
5f7c6b64b69d84c89d87c69b259649b6

SHA1
e96b5cb3f299f1e373dfd8bffa2d493d7fce0aaf

SHA256
cec3a8e1c75e32aae6f9644b5c42928cc3aecb1b3a04b70bf0dffb9285ead9e1

SHA512
121bb6146dc39bdf240fb8080402fec384e854ac33dc458ebcb6cd6b8e8f3f1c471c83c9e24ea80fea264fca245f81d9f30a4aefad01f3343353e5d83eadb0ac

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr

Filesize
467KB

MD5
5f7c6b64b69d84c89d87c69b259649b6

SHA1
e96b5cb3f299f1e373dfd8bffa2d493d7fce0aaf

SHA256
cec3a8e1c75e32aae6f9644b5c42928cc3aecb1b3a04b70bf0dffb9285ead9e1

SHA512
121bb6146dc39bdf240fb8080402fec384e854ac33dc458ebcb6cd6b8e8f3f1c471c83c9e24ea80fea264fca245f81d9f30a4aefad01f3343353e5d83eadb0ac

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\FileName.scr

Filesize
467KB

MD5
5f7c6b64b69d84c89d87c69b259649b6

SHA1
e96b5cb3f299f1e373dfd8bffa2d493d7fce0aaf

SHA256
cec3a8e1c75e32aae6f9644b5c42928cc3aecb1b3a04b70bf0dffb9285ead9e1

SHA512
121bb6146dc39bdf240fb8080402fec384e854ac33dc458ebcb6cd6b8e8f3f1c471c83c9e24ea80fea264fca245f81d9f30a4aefad01f3343353e5d83eadb0ac

Download Submit
\Users\Admin\AppData\Roaming\FolderName\FileName.scr

Filesize
467KB

MD5
5f7c6b64b69d84c89d87c69b259649b6

SHA1
e96b5cb3f299f1e373dfd8bffa2d493d7fce0aaf

SHA256
cec3a8e1c75e32aae6f9644b5c42928cc3aecb1b3a04b70bf0dffb9285ead9e1

SHA512
121bb6146dc39bdf240fb8080402fec384e854ac33dc458ebcb6cd6b8e8f3f1c471c83c9e24ea80fea264fca245f81d9f30a4aefad01f3343353e5d83eadb0ac

Download Submit
\Users\Admin\AppData\Roaming\FolderName\FileName.scr

Filesize
467KB

MD5
5f7c6b64b69d84c89d87c69b259649b6

SHA1
e96b5cb3f299f1e373dfd8bffa2d493d7fce0aaf

SHA256
cec3a8e1c75e32aae6f9644b5c42928cc3aecb1b3a04b70bf0dffb9285ead9e1

SHA512
121bb6146dc39bdf240fb8080402fec384e854ac33dc458ebcb6cd6b8e8f3f1c471c83c9e24ea80fea264fca245f81d9f30a4aefad01f3343353e5d83eadb0ac

Download Submit
\Users\Admin\AppData\Roaming\FolderName\FileName.scr

Filesize
467KB

MD5
5f7c6b64b69d84c89d87c69b259649b6

SHA1
e96b5cb3f299f1e373dfd8bffa2d493d7fce0aaf

SHA256
cec3a8e1c75e32aae6f9644b5c42928cc3aecb1b3a04b70bf0dffb9285ead9e1

SHA512
121bb6146dc39bdf240fb8080402fec384e854ac33dc458ebcb6cd6b8e8f3f1c471c83c9e24ea80fea264fca245f81d9f30a4aefad01f3343353e5d83eadb0ac

Download Submit
\Users\Admin\AppData\Roaming\FolderName\FileName.scr

Filesize
467KB

MD5
5f7c6b64b69d84c89d87c69b259649b6

SHA1
e96b5cb3f299f1e373dfd8bffa2d493d7fce0aaf

SHA256
cec3a8e1c75e32aae6f9644b5c42928cc3aecb1b3a04b70bf0dffb9285ead9e1

SHA512
121bb6146dc39bdf240fb8080402fec384e854ac33dc458ebcb6cd6b8e8f3f1c471c83c9e24ea80fea264fca245f81d9f30a4aefad01f3343353e5d83eadb0ac

Download Submit
\Users\Admin\AppData\Roaming\FolderName\FileName.scr

Filesize
467KB

MD5
5f7c6b64b69d84c89d87c69b259649b6

SHA1
e96b5cb3f299f1e373dfd8bffa2d493d7fce0aaf

SHA256
cec3a8e1c75e32aae6f9644b5c42928cc3aecb1b3a04b70bf0dffb9285ead9e1

SHA512
121bb6146dc39bdf240fb8080402fec384e854ac33dc458ebcb6cd6b8e8f3f1c471c83c9e24ea80fea264fca245f81d9f30a4aefad01f3343353e5d83eadb0ac

Download Submit
memory/628-83-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/628-100-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/628-73-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/628-75-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/628-76-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/628-72-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/628-81-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/628-92-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1052-147-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1056-145-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1056-183-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1056-135-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1056-163-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1056-140-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1056-184-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1056-137-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1100-101-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1100-111-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1100-94-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1100-96-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1100-86-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1100-90-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1100-82-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1100-84-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1516-156-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1516-171-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1516-164-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1604-181-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1708-63-0x00000000006F0000-0x00000000006F4000-memory.dmp

Filesize
16KB

Download
memory/1708-62-0x00000000006F0000-0x00000000006F4000-memory.dmp

Filesize
16KB

Download
memory/1708-71-0x00000000006F0000-0x00000000006F4000-memory.dmp

Filesize
16KB

Download
memory/1708-70-0x00000000006F0000-0x00000000006F4000-memory.dmp

Filesize
16KB

Download
memory/1708-58-0x0000000000400000-0x000000000056A000-memory.dmp

Filesize
1.4MB

Download
memory/1708-95-0x0000000000400000-0x000000000056A000-memory.dmp

Filesize
1.4MB

Download
memory/1708-79-0x00000000006F0000-0x00000000006F4000-memory.dmp

Filesize
16KB

Download
memory/1708-66-0x00000000006F0000-0x00000000006F4000-memory.dmp

Filesize
16KB

Download
memory/1708-67-0x00000000006F0000-0x00000000006F4000-memory.dmp

Filesize
16KB

Download
memory/1708-61-0x00000000006F0000-0x00000000006F4000-memory.dmp

Filesize
16KB

Download
memory/1708-56-0x00000000006F0000-0x00000000006F4000-memory.dmp

Filesize
16KB

Download
memory/1708-68-0x00000000006F0000-0x00000000006F4000-memory.dmp

Filesize
16KB

Download
memory/1992-149-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1992-153-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1992-182-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2020-114-0x0000000000400000-0x000000000056A000-memory.dmp

Filesize
1.4MB

Download
memory/2020-151-0x0000000000400000-0x000000000056A000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads