Analysis
-
max time kernel
65s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 14:50
Static task
static1
Behavioral task
behavioral1
Sample
Shipment doc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Shipment doc.exe
Resource
win10v2004-20221111-en
General
-
Target
Shipment doc.exe
-
Size
431KB
-
MD5
7267866e61ab496ef241adb843643536
-
SHA1
63ab40146c9f186b0c6a20b623f25f8eb58b6173
-
SHA256
3ab5088c86cf977cb96bfb1616f8f9ec791d6e3356e346364f4255370973f5d0
-
SHA512
74521abfe1f7bf286a7873e61b4e104b1f2923678dbda82e90e7e3c8abf9f61dfe200de88ac75f7bb99d9b095deb98fc7aa89210c90469b36ed38cf8f49bb104
-
SSDEEP
12288:M5yqoY2ukkEOG/8k3GSmksW2FgSiKVAEVsL4EfBj:6Nk4GEk3GSFsDgpEVruBj
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/744-61-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/744-63-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/744-64-0x0000000000401180-mapping.dmp family_isrstealer behavioral1/memory/744-73-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/744-88-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer -
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1120-80-0x000000000041C410-mapping.dmp MailPassView behavioral1/memory/1120-85-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/1120-86-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/1120-87-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
Nirsoft 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1120-80-0x000000000041C410-mapping.dmp Nirsoft behavioral1/memory/1120-85-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/1120-86-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/1120-87-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
Processes:
resource yara_rule behavioral1/memory/668-71-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/668-76-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/668-77-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/668-78-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/1120-79-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/668-83-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/1120-84-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1120-85-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1120-86-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1120-87-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
Shipment doc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts Shipment doc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Shipment doc.exeShipment doc.exedescription pid process target process PID 2036 set thread context of 744 2036 Shipment doc.exe Shipment doc.exe PID 744 set thread context of 668 744 Shipment doc.exe Shipment doc.exe PID 744 set thread context of 1120 744 Shipment doc.exe Shipment doc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Shipment doc.exepid process 2036 Shipment doc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Shipment doc.exedescription pid process Token: SeDebugPrivilege 2036 Shipment doc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Shipment doc.exepid process 744 Shipment doc.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
Shipment doc.exeShipment doc.exedescription pid process target process PID 2036 wrote to memory of 744 2036 Shipment doc.exe Shipment doc.exe PID 2036 wrote to memory of 744 2036 Shipment doc.exe Shipment doc.exe PID 2036 wrote to memory of 744 2036 Shipment doc.exe Shipment doc.exe PID 2036 wrote to memory of 744 2036 Shipment doc.exe Shipment doc.exe PID 2036 wrote to memory of 744 2036 Shipment doc.exe Shipment doc.exe PID 2036 wrote to memory of 744 2036 Shipment doc.exe Shipment doc.exe PID 2036 wrote to memory of 744 2036 Shipment doc.exe Shipment doc.exe PID 2036 wrote to memory of 744 2036 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 668 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 668 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 668 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 668 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 668 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 668 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 668 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 668 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 668 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 1120 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 1120 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 1120 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 1120 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 1120 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 1120 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 1120 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 1120 744 Shipment doc.exe Shipment doc.exe PID 744 wrote to memory of 1120 744 Shipment doc.exe Shipment doc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipment doc.exe"C:\Users\Admin\AppData\Local\Temp\Shipment doc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipment doc.exe"C:\Users\Admin\AppData\Local\Temp\Shipment doc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipment doc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\azOr88rzRS.ini"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Shipment doc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\VTvOgE42tS.ini"3⤵
- Accesses Microsoft Outlook accounts
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/668-71-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/668-83-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/668-78-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/668-77-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/668-76-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/668-72-0x00000000004512E0-mapping.dmp
-
memory/744-61-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/744-64-0x0000000000401180-mapping.dmp
-
memory/744-88-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/744-59-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/744-73-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/744-58-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/744-63-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1120-84-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1120-87-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1120-86-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1120-85-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1120-79-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1120-80-0x000000000041C410-mapping.dmp
-
memory/2036-57-0x0000000000306000-0x0000000000317000-memory.dmpFilesize
68KB
-
memory/2036-55-0x0000000074A90000-0x000000007503B000-memory.dmpFilesize
5.7MB
-
memory/2036-56-0x0000000074A90000-0x000000007503B000-memory.dmpFilesize
5.7MB
-
memory/2036-54-0x0000000076941000-0x0000000076943000-memory.dmpFilesize
8KB
-
memory/2036-68-0x0000000000306000-0x0000000000317000-memory.dmpFilesize
68KB
-
memory/2036-67-0x0000000074A90000-0x000000007503B000-memory.dmpFilesize
5.7MB