fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07

General

Target

fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07.exe
Size

211KB
MD5

fe53d500be86da4328cafcd6cc776e1f
SHA1

904a78026488292f9cf4cfda955f78d58f285a3a
SHA256

fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07
SHA512

32b6660ac7a6ba30dc83c47a1533488b8309f00627dd50093e79a3fc8bfd8d5df82c7f2f6993dff482c45eeac4d7887699485a4b0cb215f2dbf65a3f51a98e24
SSDEEP

3072:EPUHpiKT2t2UHIu05W7SAFJJOUD9cckiKop97f3r8n9t9Ygntt:9rTfUHeeSKOS9ccFKk3Y9t9Yk

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1288	Isass.exe

Loads dropped DLL 2 IoCs

pid	Process
1300	fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07.exe
1300	fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1300	fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07.exe
1288	Isass.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1288	1300	fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07.exe	27
PID 1300 wrote to memory of 1288	1300	fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07.exe	27
PID 1300 wrote to memory of 1288	1300	fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07.exe	27
PID 1300 wrote to memory of 1288	1300	fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07.exe	27

C:\Users\Admin\AppData\Local\Temp\fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07.exe
"C:\Users\Admin\AppData\Local\Temp\fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Public\Microsoft Build\Isass.exe
  "C:\Users\Public\Microsoft Build\Isass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Microsoft Build\Isass.exe

Filesize
211KB

MD5
fe53d500be86da4328cafcd6cc776e1f

SHA1
904a78026488292f9cf4cfda955f78d58f285a3a

SHA256
fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07

SHA512
32b6660ac7a6ba30dc83c47a1533488b8309f00627dd50093e79a3fc8bfd8d5df82c7f2f6993dff482c45eeac4d7887699485a4b0cb215f2dbf65a3f51a98e24

Download Submit
C:\Users\Public\Microsoft Build\Isass.exe

Filesize
211KB

MD5
fe53d500be86da4328cafcd6cc776e1f

SHA1
904a78026488292f9cf4cfda955f78d58f285a3a

SHA256
fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07

SHA512
32b6660ac7a6ba30dc83c47a1533488b8309f00627dd50093e79a3fc8bfd8d5df82c7f2f6993dff482c45eeac4d7887699485a4b0cb215f2dbf65a3f51a98e24

Download Submit
\Users\Public\Microsoft Build\Isass.exe

Filesize
211KB

MD5
fe53d500be86da4328cafcd6cc776e1f

SHA1
904a78026488292f9cf4cfda955f78d58f285a3a

SHA256
fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07

SHA512
32b6660ac7a6ba30dc83c47a1533488b8309f00627dd50093e79a3fc8bfd8d5df82c7f2f6993dff482c45eeac4d7887699485a4b0cb215f2dbf65a3f51a98e24

Download Submit
\Users\Public\Microsoft Build\Isass.exe

Filesize
211KB

MD5
fe53d500be86da4328cafcd6cc776e1f

SHA1
904a78026488292f9cf4cfda955f78d58f285a3a

SHA256
fba39a40bd5509086f6d49834fdf8463d6d4ffbf24b457f088227b61b3a50d07

SHA512
32b6660ac7a6ba30dc83c47a1533488b8309f00627dd50093e79a3fc8bfd8d5df82c7f2f6993dff482c45eeac4d7887699485a4b0cb215f2dbf65a3f51a98e24

Download Submit
memory/1288-57-0x0000000000000000-mapping.dmp

Download
memory/1288-62-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1288-63-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1288-64-0x00000000040B0000-0x0000000005358000-memory.dmp

Filesize
18.7MB

Download
memory/1300-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1300-61-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download

Analysis

Sharing