Analysis
-
max time kernel
48s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 17:02
Static task
static1
Behavioral task
behavioral1
Sample
966c8b6ae047e13474bf29b3cd01584730c94f54b942b50b6346639c798ea585.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
966c8b6ae047e13474bf29b3cd01584730c94f54b942b50b6346639c798ea585.exe
Resource
win10v2004-20220901-en
General
-
Target
966c8b6ae047e13474bf29b3cd01584730c94f54b942b50b6346639c798ea585.exe
-
Size
420KB
-
MD5
e774bca504985440420fe73b75dc00cc
-
SHA1
368fa03327594d06b8e421b74b1de49bf0780de9
-
SHA256
966c8b6ae047e13474bf29b3cd01584730c94f54b942b50b6346639c798ea585
-
SHA512
245416bdff73f6d133ecd33d514a77ce1e9ab88226dcb731581bae923d1c1feab66a5364e3670b91d4840e5b80771cd551d632c6c200b002153bce3164381761
-
SSDEEP
6144:D/VmalBrqaKxs+j26ld4h6LpNkVTqgL4/YitLJuTtnQoniQGZpvIszTuoFZL:RmOHK9KVTqgLaYitLUTyNQo1Tuo
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1136-65-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/1136-69-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/1136-71-0x0000000000401180-mapping.dmp family_isrstealer behavioral1/memory/1136-85-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/1136-90-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/1136-99-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/588-97-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/588-98-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
Nirsoft 2 IoCs
Processes:
resource yara_rule behavioral1/memory/588-97-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/588-98-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
Executes dropped EXE 4 IoCs
Processes:
winlogon.exewinlogon.exewinlogon.exewinlogon.exepid process 1516 winlogon.exe 1136 winlogon.exe 876 winlogon.exe 588 winlogon.exe -
Processes:
resource yara_rule behavioral1/memory/876-78-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/876-83-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/876-84-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/876-86-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/876-87-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/588-91-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/588-96-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/588-97-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/588-98-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
winlogon.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts winlogon.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winlogon.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe" winlogon.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
winlogon.exewinlogon.exedescription pid process target process PID 1516 set thread context of 1136 1516 winlogon.exe winlogon.exe PID 1136 set thread context of 876 1136 winlogon.exe winlogon.exe PID 1136 set thread context of 588 1136 winlogon.exe winlogon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
winlogon.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 winlogon.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e winlogon.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winlogon.exepid process 1136 winlogon.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
966c8b6ae047e13474bf29b3cd01584730c94f54b942b50b6346639c798ea585.exewinlogon.exewinlogon.exedescription pid process target process PID 1728 wrote to memory of 1516 1728 966c8b6ae047e13474bf29b3cd01584730c94f54b942b50b6346639c798ea585.exe winlogon.exe PID 1728 wrote to memory of 1516 1728 966c8b6ae047e13474bf29b3cd01584730c94f54b942b50b6346639c798ea585.exe winlogon.exe PID 1728 wrote to memory of 1516 1728 966c8b6ae047e13474bf29b3cd01584730c94f54b942b50b6346639c798ea585.exe winlogon.exe PID 1516 wrote to memory of 1136 1516 winlogon.exe winlogon.exe PID 1516 wrote to memory of 1136 1516 winlogon.exe winlogon.exe PID 1516 wrote to memory of 1136 1516 winlogon.exe winlogon.exe PID 1516 wrote to memory of 1136 1516 winlogon.exe winlogon.exe PID 1516 wrote to memory of 1136 1516 winlogon.exe winlogon.exe PID 1516 wrote to memory of 1136 1516 winlogon.exe winlogon.exe PID 1516 wrote to memory of 1136 1516 winlogon.exe winlogon.exe PID 1516 wrote to memory of 1136 1516 winlogon.exe winlogon.exe PID 1136 wrote to memory of 876 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 876 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 876 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 876 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 876 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 876 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 876 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 876 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 876 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 588 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 588 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 588 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 588 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 588 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 588 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 588 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 588 1136 winlogon.exe winlogon.exe PID 1136 wrote to memory of 588 1136 winlogon.exe winlogon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\966c8b6ae047e13474bf29b3cd01584730c94f54b942b50b6346639c798ea585.exe"C:\Users\Admin\AppData\Local\Temp\966c8b6ae047e13474bf29b3cd01584730c94f54b942b50b6346639c798ea585.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Roaming\Microsoft\winlogon.exe"C:\Users\Admin\AppData\Roaming\Microsoft\winlogon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Roaming\Microsoft\winlogon.exe/scomma "C:\Users\Admin\AppData\Local\Temp\dDeHA9U4Gq.ini"4⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Roaming\Microsoft\winlogon.exe/scomma "C:\Users\Admin\AppData\Local\Temp\LV56vJKgbR.ini"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:588
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dDeHA9U4Gq.iniFilesize
5B
MD5d1ea279fb5559c020a1b4137dc4de237
SHA1db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3
-
C:\Users\Admin\AppData\Roaming\Microsoft\winlogon.exeFilesize
4KB
MD5e1190859ab4f21e58d1873afc1b3cff2
SHA150d4f9f444dba70b9918c4b812b5d9a098e0f867
SHA2569b6f8344738cd1b954066a8099333dfa46c360700d8113312e8f1f6f22afcb73
SHA512f3924e6b6002e9122c9465d23ff5a574268800078e9fe6011e0d62dca6113ffaf786fa46338a02288d8059e09ef0e79ac96d004dacabcb708291cf4376294a38
-
C:\Users\Admin\AppData\Roaming\Microsoft\winlogon.exeFilesize
4KB
MD5e1190859ab4f21e58d1873afc1b3cff2
SHA150d4f9f444dba70b9918c4b812b5d9a098e0f867
SHA2569b6f8344738cd1b954066a8099333dfa46c360700d8113312e8f1f6f22afcb73
SHA512f3924e6b6002e9122c9465d23ff5a574268800078e9fe6011e0d62dca6113ffaf786fa46338a02288d8059e09ef0e79ac96d004dacabcb708291cf4376294a38
-
C:\Users\Admin\AppData\Roaming\Microsoft\winlogon.exeFilesize
4KB
MD5e1190859ab4f21e58d1873afc1b3cff2
SHA150d4f9f444dba70b9918c4b812b5d9a098e0f867
SHA2569b6f8344738cd1b954066a8099333dfa46c360700d8113312e8f1f6f22afcb73
SHA512f3924e6b6002e9122c9465d23ff5a574268800078e9fe6011e0d62dca6113ffaf786fa46338a02288d8059e09ef0e79ac96d004dacabcb708291cf4376294a38
-
C:\Users\Admin\AppData\Roaming\Microsoft\winlogon.exeFilesize
4KB
MD5e1190859ab4f21e58d1873afc1b3cff2
SHA150d4f9f444dba70b9918c4b812b5d9a098e0f867
SHA2569b6f8344738cd1b954066a8099333dfa46c360700d8113312e8f1f6f22afcb73
SHA512f3924e6b6002e9122c9465d23ff5a574268800078e9fe6011e0d62dca6113ffaf786fa46338a02288d8059e09ef0e79ac96d004dacabcb708291cf4376294a38
-
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exeFilesize
420KB
MD5e774bca504985440420fe73b75dc00cc
SHA1368fa03327594d06b8e421b74b1de49bf0780de9
SHA256966c8b6ae047e13474bf29b3cd01584730c94f54b942b50b6346639c798ea585
SHA512245416bdff73f6d133ecd33d514a77ce1e9ab88226dcb731581bae923d1c1feab66a5364e3670b91d4840e5b80771cd551d632c6c200b002153bce3164381761
-
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exeFilesize
420KB
MD5e774bca504985440420fe73b75dc00cc
SHA1368fa03327594d06b8e421b74b1de49bf0780de9
SHA256966c8b6ae047e13474bf29b3cd01584730c94f54b942b50b6346639c798ea585
SHA512245416bdff73f6d133ecd33d514a77ce1e9ab88226dcb731581bae923d1c1feab66a5364e3670b91d4840e5b80771cd551d632c6c200b002153bce3164381761
-
memory/588-98-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/588-97-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/588-96-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/588-92-0x000000000041C410-mapping.dmp
-
memory/588-91-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/876-79-0x00000000004512E0-mapping.dmp
-
memory/876-87-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/876-86-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/876-78-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/876-84-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/876-83-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/876-82-0x0000000075DA1000-0x0000000075DA3000-memory.dmpFilesize
8KB
-
memory/1136-90-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1136-65-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1136-85-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1136-69-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1136-71-0x0000000000401180-mapping.dmp
-
memory/1136-63-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1136-99-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1136-62-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1516-57-0x0000000000000000-mapping.dmp
-
memory/1516-60-0x000007FEF33F0000-0x000007FEF3E13000-memory.dmpFilesize
10.1MB
-
memory/1516-61-0x000007FEF2350000-0x000007FEF33E6000-memory.dmpFilesize
16.6MB
-
memory/1728-56-0x000007FEFB741000-0x000007FEFB743000-memory.dmpFilesize
8KB
-
memory/1728-55-0x000007FEF2350000-0x000007FEF33E6000-memory.dmpFilesize
16.6MB
-
memory/1728-54-0x000007FEF33F0000-0x000007FEF3E13000-memory.dmpFilesize
10.1MB