3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c

General

Target

3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe
Size

471KB
MD5

98b363683a8e60dcede60c2eb14f9db8
SHA1

e44529a588050299da729e52bbac63336c4b0feb
SHA256

3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c
SHA512

a36fc79a52300c82d0da5db8ad3f636deac0ad1512a96c1641e7bc00208c65575e65118cac53f06a4097d16af8bbdb42df94d43917ac02e92e7e3d2edac5c1a0
SSDEEP

6144:/rTfUHeeSKOS9ccFKk3Y9t9YZ7etKKAuq8QVlZsgC5AVmg1WTQp6:/n8yN0Mr8Z7LKxQVjs55AgzTQQ

Score

9^/10

persistence spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 22 IoCs

Processes:

resource	yara_rule
C:\Users\Public\Microsoft Build\Isass.exe	UPX
behavioral2/memory/1164-4-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-5-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/4192-10-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1164-11-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/4192-22-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-23-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-26-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-27-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-28-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe	UPX
behavioral2/memory/1676-32-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-33-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-38-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-42-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-48-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-49-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-60-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-61-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-69-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-73-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1676-82-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exeIsass.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	Isass.exe

Executes dropped EXE 3 IoCs

Processes:

Isass.exeIsass.exe3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe

pid process

1676 Isass.exe
4192 Isass.exe
1208 3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1676	Isass.exe
4192	Isass.exe
1208	3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exeIsass.exeIsass.exe

pid	process
1164	3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe
1164	3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe
1676	Isass.exe
1676	Isass.exe
4192	Isass.exe
4192	Isass.exe
4192	Isass.exe
4192	Isass.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exeIsass.exe

description	pid	process	target process
PID 1164 wrote to memory of 1676	1164	3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe	Isass.exe
PID 1164 wrote to memory of 1676	1164	3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe	Isass.exe
PID 1164 wrote to memory of 1676	1164	3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe	Isass.exe
PID 1164 wrote to memory of 4192	1164	3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe	Isass.exe
PID 1164 wrote to memory of 4192	1164	3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe	Isass.exe
PID 1164 wrote to memory of 4192	1164	3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe	Isass.exe
PID 4192 wrote to memory of 1208	4192	Isass.exe	3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe
PID 4192 wrote to memory of 1208	4192	Isass.exe	3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe

C:\Users\Admin\AppData\Local\Temp\3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe
"C:\Users\Admin\AppData\Local\Temp\3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1164

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1676

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4192

C:\Users\Admin\AppData\Local\Temp\3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe
"C:\Users\Admin\AppData\Local\Temp\3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe"
3⤵
- Executes dropped EXE
PID:1208

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
Filesize
698KB

MD5
c11c760d2b4d8d1d70779d71cdde1480

SHA1
c3d5711ab16489eabccab4d4b036a19acc026226

SHA256
9fdd140599c1daf85c9b217ddaef65b5669ad8a83a3ee4d761ebc1f2cb3026b6

SHA512
6d1e0f0bedd4bb3e162bbd05f7689ada2bbbe71fdd24c3ea5e02263c3aafa03640acc810b142dc02789c4b39d59709e4756b5d46d2b6b649a2422b1d13f6404c

Download Submit
C:\Users\Admin\AppData\Local\Temp\3d6f3f108a62faec1933572673d5fa5d765fab938ad3e90e5054c682a484138c.exe
Filesize
250KB

MD5
9386c7ffb682c69eadb492071138f495

SHA1
cd4cda7c97645a9ce694f9543b989e5fb898bbe7

SHA256
a4c297fc0b96651ebb71b15398025f80d1f6f592330792ba3eb01d9cd56f9f99

SHA512
9b7c2ee269d6f6f33f8656d9e3958036b441246304dce499e9ada4c7dc844a8d4b42deafc5e1d25dc50d069393f0ce9cdc5765a7ca7b3393511d1defba4f7d21

Download Submit
C:\Users\Public\Microsoft Build\Isass.exe
Filesize
216KB

MD5
29bb7e7cca12ac73ec2b0e41b6c83779

SHA1
0c88182bf3f8f613943c9c7bf7456fbf7167efaf

SHA256
248278293dcf1bb593e80f8623561fca82982284c23ffc856b6fcd0f1d014654

SHA512
19440174d2dc12433ccc949cd050eb3fa8dae11cb764fa3ddd53bf3069a0ee738cba584181fd12db42724ebfb4bfa7795aff8a01062c4077527278549dd58190

Download Submit
memory/1164-11-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1164-4-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1164-6-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/1676-28-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-33-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-82-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-23-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-26-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-27-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-7-0x0000000001A60000-0x0000000001A61000-memory.dmp

Filesize
4KB

Download
memory/1676-5-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-32-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-73-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-38-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-42-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-48-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-49-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-60-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-61-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1676-69-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/4192-10-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/4192-22-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads