91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76

General

Target

91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76.exe
Size

320KB
MD5

349f83c09896d396084fd9b69987833b
SHA1

e520760f0daaf156ef8c062fb98c939d517100ba
SHA256

91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76
SHA512

899d3240054ac42cc60774001b17a2b08dc0b44838bc65bb4e565ed95ac93f38d90843839adf4e7878a670918ba5950159a89e998575f9aade9e7fb5aa072ad4
SSDEEP

6144:9rTfUHeeSKOS9ccFKk3Y9t9YV3v3/sSQJw1TfLYTTZJS:9n8yN0Mr8eJw1aXS

Score

9^/10

persistence spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 19 IoCs

Processes:

resource	yara_rule
C:\Users\Public\Microsoft Build\Isass.exe	UPX
behavioral2/memory/3676-4-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/3676-5-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1296-6-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1296-8-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1296-11-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1296-12-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe	UPX
behavioral2/memory/1296-16-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1296-17-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1296-22-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1296-26-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1296-32-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1296-33-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1296-40-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1296-41-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1296-49-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1296-53-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1296-62-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

Isass.exe

pid process

1296 Isass.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1296	Isass.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76.exeIsass.exe

pid	process
3676	91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76.exe
3676	91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76.exe
1296	Isass.exe
1296	Isass.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76.exe

description	pid	process	target process
PID 3676 wrote to memory of 1296	3676	91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76.exe	Isass.exe
PID 3676 wrote to memory of 1296	3676	91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76.exe	Isass.exe
PID 3676 wrote to memory of 1296	3676	91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76.exe	Isass.exe

C:\Users\Admin\AppData\Local\Temp\91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76.exe
"C:\Users\Admin\AppData\Local\Temp\91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3676

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe

Filesize
828KB

MD5
e468565486f790a14ceecfeea8abea15

SHA1
36374d43b5fa74a8e21b81ca753ff2d9d422aab1

SHA256
68c2392a9a118d95914aa63b7c3e0bdffb84ec032d9a51850a8b15312cb25489

SHA512
a1aff1e069e9dceb62403974fd84d91b332c84a27a803701b780dcb467f781d37226d7e7d479f94a1df0dd158b5ef3cd1b535b59302844b711dfc367c563b7a5

Download Submit
C:\Users\Public\Microsoft Build\Isass.exe

Filesize
320KB

MD5
349f83c09896d396084fd9b69987833b

SHA1
e520760f0daaf156ef8c062fb98c939d517100ba

SHA256
91df88a8c06205a2778a876b4fdc38f410ec6cd17462c005aae4f2f5dfb6be76

SHA512
899d3240054ac42cc60774001b17a2b08dc0b44838bc65bb4e565ed95ac93f38d90843839adf4e7878a670918ba5950159a89e998575f9aade9e7fb5aa072ad4

Download Submit
memory/1296-17-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1296-22-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1296-7-0x0000000001E60000-0x0000000001E61000-memory.dmp

Filesize
4KB

Download
memory/1296-8-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1296-11-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1296-12-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1296-62-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1296-16-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1296-53-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1296-6-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1296-26-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1296-32-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1296-33-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1296-40-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1296-41-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1296-49-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/3676-4-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/3676-5-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads