706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93

General

Target

706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
Size

479KB
MD5

6807f2e692f91e23e09af0ba65001ea7
SHA1

ed68648edfa4e2349ae845670a2ad70d47c494a8
SHA256

706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93
SHA512

b3009c79bde49c080813b5006dfbde7e63c893eba0bcc745c2ce2a19981305dc36f7a82c3fee2c17bf12e5d1ed003f4a46c74ca4945a10393d77348e3e8b06e3
SSDEEP

6144:/rTfUHeeSKOS9ccFKk3Y9t9YZGXPwwWJvcvp7lszsmAgFV:/n8yN0Mr8Z1JJqp7lsAcFV

Score

9^/10

persistence spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 22 IoCs

Processes:

resource	yara_rule
\Users\Public\Microsoft Build\Isass.exe	UPX
behavioral1/memory/2784-9-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-15-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2784-17-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/1296-18-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2664-21-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2716-29-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-30-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-31-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-34-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-35-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-42-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-43-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-51-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-52-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-58-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-59-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-71-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-72-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-80-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-81-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2980-93-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX

Executes dropped EXE 4 IoCs

Processes:

Isass.exeIsass.exeIsass.exe706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe

pid process

2980 Isass.exe
1296 Isass.exe
2716 Isass.exe
1352 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe

pid	process
2980	Isass.exe
1296	Isass.exe
2716	Isass.exe
1352	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe

Loads dropped DLL 8 IoCs

Processes:

706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exeIsass.exeIsass.exe

pid	process
2784	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
2784	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
2784	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
2784	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
2664	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
2664	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
2716	Isass.exe
2980	Isass.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exeIsass.exeIsass.exe706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exeIsass.exe

pid	process
2784	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
2980	Isass.exe
1296	Isass.exe
1296	Isass.exe
1296	Isass.exe
2664	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
2716	Isass.exe
2716	Isass.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exeIsass.exe706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exeIsass.exe

description	pid	process	target process
PID 2784 wrote to memory of 2980	2784	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe	Isass.exe
PID 2784 wrote to memory of 2980	2784	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe	Isass.exe
PID 2784 wrote to memory of 2980	2784	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe	Isass.exe
PID 2784 wrote to memory of 2980	2784	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe	Isass.exe
PID 2784 wrote to memory of 1296	2784	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe	Isass.exe
PID 2784 wrote to memory of 1296	2784	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe	Isass.exe
PID 2784 wrote to memory of 1296	2784	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe	Isass.exe
PID 2784 wrote to memory of 1296	2784	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe	Isass.exe
PID 1296 wrote to memory of 2664	1296	Isass.exe	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
PID 1296 wrote to memory of 2664	1296	Isass.exe	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
PID 1296 wrote to memory of 2664	1296	Isass.exe	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
PID 1296 wrote to memory of 2664	1296	Isass.exe	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
PID 2664 wrote to memory of 2716	2664	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe	Isass.exe
PID 2664 wrote to memory of 2716	2664	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe	Isass.exe
PID 2664 wrote to memory of 2716	2664	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe	Isass.exe
PID 2664 wrote to memory of 2716	2664	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe	Isass.exe
PID 2716 wrote to memory of 1352	2716	Isass.exe	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
PID 2716 wrote to memory of 1352	2716	Isass.exe	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
PID 2716 wrote to memory of 1352	2716	Isass.exe	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
PID 2716 wrote to memory of 1352	2716	Isass.exe	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
PID 2716 wrote to memory of 1352	2716	Isass.exe	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
PID 2716 wrote to memory of 1352	2716	Isass.exe	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
PID 2716 wrote to memory of 1352	2716	Isass.exe	706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe

C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
"C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2784

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2980

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1296

C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
"C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2664

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2716

C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
"C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe"
5⤵
- Executes dropped EXE
PID:1352

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
Filesize
231KB

MD5
6f581a41167d2d484fcba20e6fc3c39a

SHA1
d48de48d24101b9baaa24f674066577e38e6b75c

SHA256
3eb8d53778eab9fb13b4c97aeab56e4bad2a6ea3748d342f22eaf4d7aa3185a7

SHA512
e1177b6cea89445d58307b3327c78909adff225497f9abb8de571cdd114b547a8f515ec3ab038b583bf752a085b231f6329d6ca82fbe6be8a58cd97a1dbaf0f6

Download Submit
\Users\Public\Microsoft Build\Isass.exe
Filesize
216KB

MD5
a3ad4bb8992ece993d8c09ee10415f5b

SHA1
cf45b42df1234f09ef9a0e512d49dcd8d753f7b2

SHA256
ac4577a14de2d0783f2c4aa3aa1992c6a8081c0b2a2358e0ad2aaaf079041e68

SHA512
bfde1ff931c91392db6dc0a84c0b2cc47e695ae5fbb507615f37c02acdf0efe890e283ed7a8818ec352d7ba5b6946e5f31b2f5ecd2d2f41cd2ef3698dd395dd2

Download Submit
memory/1296-18-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2664-21-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2716-29-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2784-9-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2784-14-0x0000000004760000-0x0000000005A09000-memory.dmp

Filesize
18.7MB

Download
memory/2784-17-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-34-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-52-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-30-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-31-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-15-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-35-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-42-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-43-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-51-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-16-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2980-58-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-59-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-71-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-72-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-80-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-81-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2980-93-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads