isrstealer | fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352

Analysis

max time kernel
151s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
Size 356KB
Sample221122-v6zv2afa4v
SHA256 fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352
MD5 1fe3f8b81022b3cf855e64e35357a122
SHA1 0478b298ba8c99e119ffe09c5abb2c4e6303d38c
SHA512 c230b3f42a9fef50712fda78b41d3be4c10f6339557312ef6e1145f33c2598177b4a47508c5966053d92c7478d967103e3300e1c9c59537a4f4cfd009bbee2db
SSDEEP 6144:ytH2Sl7xlCFWzTFoheIuejkVVulZJ0ZSxpOwfyJv:ytHjl9lCI9s3Rk2DJ0kxpZfy5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

isrstealer collection persistence stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 8 IoCs

resource	yara_rule
behavioral2/memory/3832-135-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/3832-137-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/3832-145-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/3832-153-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/1864-166-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/1864-172-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/1864-185-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/1864-186-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4512-151-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral2/memory/4512-152-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral2/memory/1932-183-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral2/memory/1932-184-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Nirsoft 4 IoCs

resource	yara_rule
behavioral2/memory/4512-151-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/4512-152-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/1932-183-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/1932-184-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

Executes dropped EXE 6 IoCs

pid	Process
5036	WUDHost.exe
4116	Acctres.exe
1864	Acctres.exe
2556	Acctres.exe
1364	WUDHost.exe
1932	Acctres.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4512-148-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4512-150-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4512-151-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4512-152-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1932-182-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1932-183-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1932-184-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Acctres.exe

Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Acctres.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe"	WUDHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe"	WUDHost.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 3832	2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	79
PID 3832 set thread context of 1576	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	80
PID 3832 set thread context of 4512	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	86
PID 4116 set thread context of 1864	4116	Acctres.exe	93
PID 1864 set thread context of 2556	1864	Acctres.exe	94
PID 1864 set thread context of 1932	1864	Acctres.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4968	1576	WerFault.exe	80
2112	2556	WerFault.exe	94

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
Token: SeDebugPrivilege	5036	WUDHost.exe
Token: SeDebugPrivilege	4116	Acctres.exe
Token: SeDebugPrivilege	1364	WUDHost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
1864	Acctres.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3832	2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	79
PID 2412 wrote to memory of 3832	2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	79
PID 2412 wrote to memory of 3832	2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	79
PID 2412 wrote to memory of 3832	2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	79
PID 2412 wrote to memory of 3832	2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	79
PID 2412 wrote to memory of 3832	2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	79
PID 2412 wrote to memory of 3832	2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	79
PID 3832 wrote to memory of 1576	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	80
PID 3832 wrote to memory of 1576	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	80
PID 3832 wrote to memory of 1576	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	80
PID 3832 wrote to memory of 1576	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	80
PID 3832 wrote to memory of 1576	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	80
PID 3832 wrote to memory of 1576	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	80
PID 3832 wrote to memory of 1576	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	80
PID 3832 wrote to memory of 1576	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	80
PID 2412 wrote to memory of 5036	2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	83
PID 2412 wrote to memory of 5036	2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	83
PID 2412 wrote to memory of 5036	2412	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	83
PID 3832 wrote to memory of 4512	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	86
PID 3832 wrote to memory of 4512	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	86
PID 3832 wrote to memory of 4512	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	86
PID 3832 wrote to memory of 4512	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	86
PID 3832 wrote to memory of 4512	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	86
PID 3832 wrote to memory of 4512	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	86
PID 3832 wrote to memory of 4512	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	86
PID 3832 wrote to memory of 4512	3832	fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe	86
PID 5036 wrote to memory of 4116	5036	WUDHost.exe	87
PID 5036 wrote to memory of 4116	5036	WUDHost.exe	87
PID 5036 wrote to memory of 4116	5036	WUDHost.exe	87
PID 4116 wrote to memory of 1864	4116	Acctres.exe	93
PID 4116 wrote to memory of 1864	4116	Acctres.exe	93
PID 4116 wrote to memory of 1864	4116	Acctres.exe	93
PID 4116 wrote to memory of 1864	4116	Acctres.exe	93
PID 4116 wrote to memory of 1864	4116	Acctres.exe	93
PID 4116 wrote to memory of 1864	4116	Acctres.exe	93
PID 4116 wrote to memory of 1864	4116	Acctres.exe	93
PID 1864 wrote to memory of 2556	1864	Acctres.exe	94
PID 1864 wrote to memory of 2556	1864	Acctres.exe	94
PID 1864 wrote to memory of 2556	1864	Acctres.exe	94
PID 1864 wrote to memory of 2556	1864	Acctres.exe	94
PID 1864 wrote to memory of 2556	1864	Acctres.exe	94
PID 1864 wrote to memory of 2556	1864	Acctres.exe	94
PID 1864 wrote to memory of 2556	1864	Acctres.exe	94
PID 1864 wrote to memory of 2556	1864	Acctres.exe	94
PID 4116 wrote to memory of 1364	4116	Acctres.exe	98
PID 4116 wrote to memory of 1364	4116	Acctres.exe	98
PID 4116 wrote to memory of 1364	4116	Acctres.exe	98
PID 1864 wrote to memory of 1932	1864	Acctres.exe	99
PID 1864 wrote to memory of 1932	1864	Acctres.exe	99
PID 1864 wrote to memory of 1932	1864	Acctres.exe	99
PID 1864 wrote to memory of 1932	1864	Acctres.exe	99
PID 1864 wrote to memory of 1932	1864	Acctres.exe	99
PID 1864 wrote to memory of 1932	1864	Acctres.exe	99
PID 1864 wrote to memory of 1932	1864	Acctres.exe	99
PID 1864 wrote to memory of 1932	1864	Acctres.exe	99

C:\Users\Admin\AppData\Local\Temp\fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
"C:\Users\Admin\AppData\Local\Temp\fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
  "C:\Users\Admin\AppData\Local\Temp\fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Users\Admin\AppData\Local\Temp\fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\l2XT7lIkzM.ini"
    3⤵
    PID:1576
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 80
      4⤵
      Program crash
      PID:4968
- - C:\Users\Admin\AppData\Local\Temp\fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\XeapD9jg1q.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4512
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\xU3MDGOcqM.ini"
        5⤵
        Executes dropped EXE
        
        PID:2556
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 80
        6⤵
        Program crash
        
        PID:2112
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\9dAVoRfaDa.ini"
        5⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:1932
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1576 -ip 1576
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2556 -ip 2556
1⤵
PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WUDHost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\WUDHost.exe.log
Size 319B
SHA256 d182dd648c92e41cd62dccc65f130c07f0a96c03b32f907c3d1218e9aa5bda03
MD5 824ba7b7eed8b900a98dd25129c4cd83
SHA1 54478770b2158000ef365591d42977cb854453a1
SHA512 ae4f3a9673711ecb6cc5d06874c587341d5094803923b53b6e982278fa64549d7acf866de165e23750facd55da556b6794c0d32f129f4087529c73acd4ffb11e
MD5 SHA1 SHA512

Submit Download

Acctres.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
Size 356KB
SHA256 fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352
MD5 1fe3f8b81022b3cf855e64e35357a122
SHA1 0478b298ba8c99e119ffe09c5abb2c4e6303d38c
SHA512 c230b3f42a9fef50712fda78b41d3be4c10f6339557312ef6e1145f33c2598177b4a47508c5966053d92c7478d967103e3300e1c9c59537a4f4cfd009bbee2db
SSDEEP 6144:ytH2Sl7xlCFWzTFoheIuejkVVulZJ0ZSxpOwfyJv:ytHjl9lCI9s3Rk2DJ0kxpZfy5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Acctres.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
Size 356KB
SHA256 fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352
MD5 1fe3f8b81022b3cf855e64e35357a122
SHA1 0478b298ba8c99e119ffe09c5abb2c4e6303d38c
SHA512 c230b3f42a9fef50712fda78b41d3be4c10f6339557312ef6e1145f33c2598177b4a47508c5966053d92c7478d967103e3300e1c9c59537a4f4cfd009bbee2db
SSDEEP 6144:ytH2Sl7xlCFWzTFoheIuejkVVulZJ0ZSxpOwfyJv:ytHjl9lCI9s3Rk2DJ0kxpZfy5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Acctres.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
Size 356KB
SHA256 fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352
MD5 1fe3f8b81022b3cf855e64e35357a122
SHA1 0478b298ba8c99e119ffe09c5abb2c4e6303d38c
SHA512 c230b3f42a9fef50712fda78b41d3be4c10f6339557312ef6e1145f33c2598177b4a47508c5966053d92c7478d967103e3300e1c9c59537a4f4cfd009bbee2db
SSDEEP 6144:ytH2Sl7xlCFWzTFoheIuejkVVulZJ0ZSxpOwfyJv:ytHjl9lCI9s3Rk2DJ0kxpZfy5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Acctres.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
Size 356KB
SHA256 fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352
MD5 1fe3f8b81022b3cf855e64e35357a122
SHA1 0478b298ba8c99e119ffe09c5abb2c4e6303d38c
SHA512 c230b3f42a9fef50712fda78b41d3be4c10f6339557312ef6e1145f33c2598177b4a47508c5966053d92c7478d967103e3300e1c9c59537a4f4cfd009bbee2db
SSDEEP 6144:ytH2Sl7xlCFWzTFoheIuejkVVulZJ0ZSxpOwfyJv:ytHjl9lCI9s3Rk2DJ0kxpZfy5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Acctres.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
Size 356KB
SHA256 fe65f1cd991967ac9c378444f77f4039153015d7d42a12d95077c36015582352
MD5 1fe3f8b81022b3cf855e64e35357a122
SHA1 0478b298ba8c99e119ffe09c5abb2c4e6303d38c
SHA512 c230b3f42a9fef50712fda78b41d3be4c10f6339557312ef6e1145f33c2598177b4a47508c5966053d92c7478d967103e3300e1c9c59537a4f4cfd009bbee2db
SSDEEP 6144:ytH2Sl7xlCFWzTFoheIuejkVVulZJ0ZSxpOwfyJv:ytHjl9lCI9s3Rk2DJ0kxpZfy5
MD5 SHA1 SHA512 SSDEEP

Submit Download

WUDHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
Size 11KB
SHA256 933fa76fbbaff480ee54c270901ded9da46b417502bd3e4062580a54f0a68084
MD5 6250064b24fd9175bdad1c147fe6f209
SHA1 9c777e8318c8967625a829551ce561453d88e964
SHA512 3db783ef0fb348cf9a354052f8f0e907bc91b6b5bf807aea22731f5710e81f0af1a44c29434fa9169187077e941a1990f57ba0ab10c51a5243bb67fcb57d0f48
SSDEEP 192:8hIx4GyxMBubSJxcOXh3H3xCBUBLGD20eqZNr0mgI14EEb:rW7ZbEKOZH34BUBLG20dNr0mgIyEE
MD5 SHA1 SHA512 SSDEEP

Submit Download

WUDHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
Size 11KB
SHA256 933fa76fbbaff480ee54c270901ded9da46b417502bd3e4062580a54f0a68084
MD5 6250064b24fd9175bdad1c147fe6f209
SHA1 9c777e8318c8967625a829551ce561453d88e964
SHA512 3db783ef0fb348cf9a354052f8f0e907bc91b6b5bf807aea22731f5710e81f0af1a44c29434fa9169187077e941a1990f57ba0ab10c51a5243bb67fcb57d0f48
SSDEEP 192:8hIx4GyxMBubSJxcOXh3H3xCBUBLGD20eqZNr0mgI14EEb:rW7ZbEKOZH34BUBLG20dNr0mgIyEE
MD5 SHA1 SHA512 SSDEEP

Submit Download

WUDHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
Size 11KB
SHA256 933fa76fbbaff480ee54c270901ded9da46b417502bd3e4062580a54f0a68084
MD5 6250064b24fd9175bdad1c147fe6f209
SHA1 9c777e8318c8967625a829551ce561453d88e964
SHA512 3db783ef0fb348cf9a354052f8f0e907bc91b6b5bf807aea22731f5710e81f0af1a44c29434fa9169187077e941a1990f57ba0ab10c51a5243bb67fcb57d0f48
SSDEEP 192:8hIx4GyxMBubSJxcOXh3H3xCBUBLGD20eqZNr0mgI14EEb:rW7ZbEKOZH34BUBLG20dNr0mgIyEE
MD5 SHA1 SHA512 SSDEEP

Submit Download

WUDHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
Size 11KB
SHA256 933fa76fbbaff480ee54c270901ded9da46b417502bd3e4062580a54f0a68084
MD5 6250064b24fd9175bdad1c147fe6f209
SHA1 9c777e8318c8967625a829551ce561453d88e964
SHA512 3db783ef0fb348cf9a354052f8f0e907bc91b6b5bf807aea22731f5710e81f0af1a44c29434fa9169187077e941a1990f57ba0ab10c51a5243bb67fcb57d0f48
SSDEEP 192:8hIx4GyxMBubSJxcOXh3H3xCBUBLGD20eqZNr0mgI14EEb:rW7ZbEKOZH34BUBLG20dNr0mgIyEE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1364-177-0x0000000075590000-0x0000000075B41000-memory.dmp

Download

memory/1364-187-0x0000000075590000-0x0000000075B41000-memory.dmp

Download

memory/1864-186-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1864-185-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1864-172-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1864-166-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1932-183-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1932-184-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1932-182-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2412-132-0x0000000075590000-0x0000000075B41000-memory.dmp

Download

memory/2412-161-0x0000000075590000-0x0000000075B41000-memory.dmp

Download

memory/2412-133-0x0000000075590000-0x0000000075B41000-memory.dmp

Download

memory/3832-137-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3832-135-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3832-145-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3832-153-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4116-159-0x0000000075590000-0x0000000075B41000-memory.dmp

Download

memory/4116-158-0x0000000075590000-0x0000000075B41000-memory.dmp

Download

memory/4512-152-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4512-151-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4512-150-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4512-148-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5036-160-0x0000000075590000-0x0000000075B41000-memory.dmp

Download

memory/5036-154-0x0000000075590000-0x0000000075B41000-memory.dmp

Download

memory/5036-146-0x0000000075590000-0x0000000075B41000-memory.dmp

Download