Analysis
-
max time kernel
149s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 22:28
Static task
static1
Behavioral task
behavioral1
Sample
706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
Resource
win10v2004-20240419-en
General
-
Target
706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
-
Size
479KB
-
MD5
6807f2e692f91e23e09af0ba65001ea7
-
SHA1
ed68648edfa4e2349ae845670a2ad70d47c494a8
-
SHA256
706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93
-
SHA512
b3009c79bde49c080813b5006dfbde7e63c893eba0bcc745c2ce2a19981305dc36f7a82c3fee2c17bf12e5d1ed003f4a46c74ca4945a10393d77348e3e8b06e3
-
SSDEEP
6144:/rTfUHeeSKOS9ccFKk3Y9t9YZGXPwwWJvcvp7lszsmAgFV:/n8yN0Mr8Z1JJqp7lsAcFV
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 25 IoCs
Processes:
resource yara_rule C:\Users\Public\Microsoft Build\Isass.exe UPX behavioral2/memory/4372-4-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/4372-6-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/116-7-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/3152-9-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/3152-10-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/1100-13-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/4004-15-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/4004-25-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/116-26-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/116-29-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/1100-31-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/116-32-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe UPX behavioral2/memory/116-36-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/116-37-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/116-45-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/116-46-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/116-52-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/116-53-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/116-61-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/116-65-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/116-76-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/116-77-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX behavioral2/memory/116-86-0x0000000000400000-0x00000000016A8E52-memory.dmp UPX -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exeIsass.exe706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exeIsass.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation Isass.exe Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation Isass.exe -
Executes dropped EXE 4 IoCs
Processes:
Isass.exeIsass.exeIsass.exe706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exepid process 116 Isass.exe 3152 Isass.exe 4004 Isass.exe 1568 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe" 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe" 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exeIsass.exeIsass.exe706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exeIsass.exepid process 4372 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe 4372 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe 116 Isass.exe 116 Isass.exe 3152 Isass.exe 3152 Isass.exe 3152 Isass.exe 3152 Isass.exe 3152 Isass.exe 3152 Isass.exe 1100 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe 1100 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe 4004 Isass.exe 4004 Isass.exe 4004 Isass.exe 4004 Isass.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exeIsass.exe706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exeIsass.exedescription pid process target process PID 4372 wrote to memory of 116 4372 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe Isass.exe PID 4372 wrote to memory of 116 4372 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe Isass.exe PID 4372 wrote to memory of 116 4372 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe Isass.exe PID 4372 wrote to memory of 3152 4372 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe Isass.exe PID 4372 wrote to memory of 3152 4372 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe Isass.exe PID 4372 wrote to memory of 3152 4372 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe Isass.exe PID 3152 wrote to memory of 1100 3152 Isass.exe 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe PID 3152 wrote to memory of 1100 3152 Isass.exe 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe PID 3152 wrote to memory of 1100 3152 Isass.exe 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe PID 1100 wrote to memory of 4004 1100 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe Isass.exe PID 1100 wrote to memory of 4004 1100 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe Isass.exe PID 1100 wrote to memory of 4004 1100 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe Isass.exe PID 4004 wrote to memory of 1568 4004 Isass.exe 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe PID 4004 wrote to memory of 1568 4004 Isass.exe 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe PID 4004 wrote to memory of 1568 4004 Isass.exe 706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe"C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Public\Microsoft Build\Isass.exe"C:\Users\Public\Microsoft Build\Isass.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:116 -
C:\Users\Public\Microsoft Build\Isass.exe"C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe"C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Public\Microsoft Build\Isass.exe"C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe"C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exe"5⤵
- Executes dropped EXE
PID:1568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeFilesize
737KB
MD530c803dbd046955e593ac4054822f2ae
SHA18cb37718e16215d48ec7e5bc2a4036d4730c8142
SHA256bf8a86ee12fb1ba9da06ec80a759666296d3f615f38a76680a9c79038d22c62e
SHA5122c1874bba54fe72b94fa43f54b8ad6d8ec5284babb5a4a05c703e49bd9bf8d89386dc6dbce7f8eab5a12fa463128c79985366f7f5938d3740e9ce35cdd4b39a7
-
C:\Users\Admin\AppData\Local\Temp\706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93.exeFilesize
231KB
MD56f581a41167d2d484fcba20e6fc3c39a
SHA1d48de48d24101b9baaa24f674066577e38e6b75c
SHA2563eb8d53778eab9fb13b4c97aeab56e4bad2a6ea3748d342f22eaf4d7aa3185a7
SHA512e1177b6cea89445d58307b3327c78909adff225497f9abb8de571cdd114b547a8f515ec3ab038b583bf752a085b231f6329d6ca82fbe6be8a58cd97a1dbaf0f6
-
C:\Users\Public\Microsoft Build\Isass.exeFilesize
216KB
MD5a3ad4bb8992ece993d8c09ee10415f5b
SHA1cf45b42df1234f09ef9a0e512d49dcd8d753f7b2
SHA256ac4577a14de2d0783f2c4aa3aa1992c6a8081c0b2a2358e0ad2aaaf079041e68
SHA512bfde1ff931c91392db6dc0a84c0b2cc47e695ae5fbb507615f37c02acdf0efe890e283ed7a8818ec352d7ba5b6946e5f31b2f5ecd2d2f41cd2ef3698dd395dd2
-
memory/116-61-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/116-53-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/116-76-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/116-65-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/116-8-0x0000000001B60000-0x0000000001B61000-memory.dmpFilesize
4KB
-
memory/116-45-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/116-77-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/116-7-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/116-26-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/116-29-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/116-52-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/116-46-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/116-32-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/116-86-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/116-36-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/116-37-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/1100-13-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/1100-31-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/3152-30-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/3152-10-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/3152-9-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/4004-25-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/4004-15-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/4372-6-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB
-
memory/4372-4-0x0000000000400000-0x00000000016A8E52-memory.dmpFilesize
18.7MB