Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
08-01-2024 06:00
Static task
static1
Behavioral task
behavioral1
Sample
4a9fa940e898ebcc4f723cad30f0ad07.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4a9fa940e898ebcc4f723cad30f0ad07.exe
Resource
win10v2004-20231215-en
General
-
Target
4a9fa940e898ebcc4f723cad30f0ad07.exe
-
Size
838KB
-
MD5
4a9fa940e898ebcc4f723cad30f0ad07
-
SHA1
d4bf4aa1811c33145d8fd41966f28fd5cdae2f88
-
SHA256
e1a4f84716f597d3bdb3097fd7d3cf6db230f853c2719156cc5a1ae1b7b5051c
-
SHA512
c23c3bbfda82df201f5f5ea429e0aa6c14ccfd8cbd43addbbfc5d77dfa0717ed02d60c7ab8a581cdfc651653223b339246374bd892cb7c546b5245e1ea0206bc
-
SSDEEP
12288:SXo30W26PmYn4QqWJgksAQYUT6eETMaICXadZe09CKEvYzQq6E+UFRZECNzYlL:SXo526e49CbaMavt0IfY8vE+MRGizML
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
isecurity.exepid process 2760 isecurity.exe -
Loads dropped DLL 3 IoCs
Processes:
4a9fa940e898ebcc4f723cad30f0ad07.exepid process 2136 4a9fa940e898ebcc4f723cad30f0ad07.exe 2136 4a9fa940e898ebcc4f723cad30f0ad07.exe 2136 4a9fa940e898ebcc4f723cad30f0ad07.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
isecurity.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security = "C:\\ProgramData\\isecurity.exe" isecurity.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
isecurity.exedescription ioc process File opened (read-only) \??\G: isecurity.exe File opened (read-only) \??\R: isecurity.exe File opened (read-only) \??\S: isecurity.exe File opened (read-only) \??\Y: isecurity.exe File opened (read-only) \??\I: isecurity.exe File opened (read-only) \??\O: isecurity.exe File opened (read-only) \??\U: isecurity.exe File opened (read-only) \??\X: isecurity.exe File opened (read-only) \??\E: isecurity.exe File opened (read-only) \??\H: isecurity.exe File opened (read-only) \??\J: isecurity.exe File opened (read-only) \??\T: isecurity.exe File opened (read-only) \??\W: isecurity.exe File opened (read-only) \??\K: isecurity.exe File opened (read-only) \??\L: isecurity.exe File opened (read-only) \??\M: isecurity.exe File opened (read-only) \??\N: isecurity.exe File opened (read-only) \??\P: isecurity.exe File opened (read-only) \??\Q: isecurity.exe File opened (read-only) \??\V: isecurity.exe File opened (read-only) \??\Z: isecurity.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
isecurity.exedescription ioc process File opened for modification \??\PhysicalDrive0 isecurity.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4a9fa940e898ebcc4f723cad30f0ad07.exeisecurity.exepid process 2136 4a9fa940e898ebcc4f723cad30f0ad07.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe -
Suspicious use of FindShellTrayWindow 17 IoCs
Processes:
isecurity.exepid process 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe -
Suspicious use of SendNotifyMessage 17 IoCs
Processes:
isecurity.exepid process 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe 2760 isecurity.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
isecurity.exepid process 2760 isecurity.exe 2760 isecurity.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
4a9fa940e898ebcc4f723cad30f0ad07.exedescription pid process target process PID 2136 wrote to memory of 2760 2136 4a9fa940e898ebcc4f723cad30f0ad07.exe isecurity.exe PID 2136 wrote to memory of 2760 2136 4a9fa940e898ebcc4f723cad30f0ad07.exe isecurity.exe PID 2136 wrote to memory of 2760 2136 4a9fa940e898ebcc4f723cad30f0ad07.exe isecurity.exe PID 2136 wrote to memory of 2760 2136 4a9fa940e898ebcc4f723cad30f0ad07.exe isecurity.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a9fa940e898ebcc4f723cad30f0ad07.exe"C:\Users\Admin\AppData\Local\Temp\4a9fa940e898ebcc4f723cad30f0ad07.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\isecurity.exeC:\ProgramData\isecurity.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\isecurity.exeFilesize
167KB
MD51cd9a151ba2a7248009264105ae53115
SHA12f99f897a1e1ba64518e0f1505dd1720ce5272f0
SHA2564e84ceaeb2853eb3db6dd47815475ca1ab8c374e42fee67a08a5a2d0f4af0d92
SHA5121a6b883a602f59f66d8a834fef4df54da987961abb31fc6151fd249041385081b9200abda27784df596c1a95e7fae4f0d44f6e59600ff0ca9fc95af38aacf125
-
C:\ProgramData\isecurity.exeFilesize
112KB
MD5195520ab18c979a519484063c6afdc63
SHA15b3bf70dc0b5d8384f46b6763a4e5bb5ae0064b1
SHA2565be6fc11f58345a2a082cc75f475b3488b0e1f9f68e337bec9c6959590dd9c69
SHA512804e9fd440c56558171814d1b4a955330daba4961b58ad199008056a5c16f530b6a14539a09288588741135d5f60d1358c011cefe5f8b991e7c4947240f4aaf2
-
\ProgramData\isecurity.exeFilesize
89KB
MD55b4e62a5cd20c3211b39659d6d39434b
SHA150eee7e0fbe9a6be973ff336d58e5a167d8bfda9
SHA25647aff75beb2cecf23e9a78dd85628cdb05e3f8cc68eb3d304aa913b5d5f58e09
SHA5129d697c244bde94d3d43e80427ca12c7f4074583975df2583843dff6377ac21c26858c60a89aba6149d1965da31cb89fade604d1d3fbb320cc58cabae8a507938
-
\ProgramData\isecurity.exeFilesize
57KB
MD50080e98e3984f5d11e216a6e6f61f709
SHA1179089992b79e70ea4a3e0c77e45ac49119af72f
SHA25641e947fee88e8b3d4a34fab0f2f41c9848ebeb02992c9cf307c44efef5cdf6b1
SHA51245938bbf33077902357139df4de518a451a0668a247e0907560739d604e121f97e6adb6a46155fa59a160498bcb6817353aee293ae0effc8b2788a307f65633a
-
\ProgramData\isecurity.exeFilesize
136KB
MD5fa815fe63806f436f2682cd330c00213
SHA148271ac11ea578e1d3382be2c6c6d4261de696da
SHA256fb80752ad92fa64bc549e0feaec80f7c312f949851420582c7fec45be3441af7
SHA5122a4989910390f13e30d6ad77ae37c19a69d17d47a086e13f9ad7b4198d6d1caf0700809e96e56a1e206eb7f1f8bc349d6db5003468acb393548fc757ec3a73e7
-
memory/2136-2-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2136-1-0x0000000000400000-0x00000000004FC000-memory.dmpFilesize
1008KB
-
memory/2136-5-0x0000000077C70000-0x0000000077C71000-memory.dmpFilesize
4KB
-
memory/2136-12-0x0000000000400000-0x00000000004FC000-memory.dmpFilesize
1008KB
-
memory/2136-0-0x0000000000400000-0x00000000004FC000-memory.dmpFilesize
1008KB
-
memory/2760-28-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-34-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-24-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-23-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-21-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-27-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-20-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-29-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-30-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-31-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2760-33-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-25-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2760-35-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-36-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-37-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-38-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-39-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-40-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-41-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-42-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-43-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB
-
memory/2760-44-0x0000000000400000-0x0000000000A3F000-memory.dmpFilesize
6.2MB