2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573

General

Target

2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
Size

316KB
MD5

7a983e05228617eb59e2583a99c011f0
SHA1

a76c01acb530654e3c2007d6ab56361fea06773f
SHA256

2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573
SHA512

ee76d466a474364c9692878236ec9c6e86c44af7192f25efeded774993a9c932853caca44c24974cedd5bc55a9d97b5f15a9fd06e05418ae4aa9037bc14d54f9
SSDEEP

6144:9rTfUHeeSKOS9ccFKk3Y9t9YTcPeLFZhTgp:9n8yN0Mr8TcPehrMp

Score

9^/10

persistence spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 22 IoCs

Processes:

resource	yara_rule
\Users\Public\Microsoft Build\Isass.exe	UPX
behavioral1/memory/2372-8-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-15-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2372-16-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2636-22-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2772-19-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2692-29-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-30-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-31-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-34-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-35-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-42-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-43-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-51-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-52-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-58-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-59-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-71-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-72-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-80-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-81-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral1/memory/2104-93-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX

Executes dropped EXE 4 IoCs

Processes:

Isass.exeIsass.exeIsass.exe2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe

pid process

2104 Isass.exe
2772 Isass.exe
2692 Isass.exe
2788 2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe

pid	process
2104	Isass.exe
2772	Isass.exe
2692	Isass.exe
2788	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe

Loads dropped DLL 8 IoCs

Processes:

2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exeIsass.exeIsass.exe

pid	process
2372	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
2372	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
2372	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
2372	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
2636	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
2636	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
2692	Isass.exe
2104	Isass.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exeIsass.exeIsass.exe2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exeIsass.exe

pid	process
2372	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
2104	Isass.exe
2772	Isass.exe
2772	Isass.exe
2772	Isass.exe
2636	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
2692	Isass.exe
2692	Isass.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exeIsass.exe2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exeIsass.exe

description	pid	process	target process
PID 2372 wrote to memory of 2104	2372	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 2372 wrote to memory of 2104	2372	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 2372 wrote to memory of 2104	2372	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 2372 wrote to memory of 2104	2372	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 2372 wrote to memory of 2772	2372	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 2372 wrote to memory of 2772	2372	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 2372 wrote to memory of 2772	2372	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 2372 wrote to memory of 2772	2372	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 2772 wrote to memory of 2636	2772	Isass.exe	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
PID 2772 wrote to memory of 2636	2772	Isass.exe	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
PID 2772 wrote to memory of 2636	2772	Isass.exe	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
PID 2772 wrote to memory of 2636	2772	Isass.exe	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
PID 2636 wrote to memory of 2692	2636	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 2636 wrote to memory of 2692	2636	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 2636 wrote to memory of 2692	2636	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 2636 wrote to memory of 2692	2636	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 2692 wrote to memory of 2788	2692	Isass.exe	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
PID 2692 wrote to memory of 2788	2692	Isass.exe	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
PID 2692 wrote to memory of 2788	2692	Isass.exe	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
PID 2692 wrote to memory of 2788	2692	Isass.exe	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe

C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
"C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2104

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2772

C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
"C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2636

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2692

C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
"C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe"
5⤵
- Executes dropped EXE
PID:2788

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
Filesize
99KB

MD5
af88cab288e8213a11a7ea5313363d31

SHA1
cb769e3246d5244a0040621e919f7c519ba49986

SHA256
7407fac6e170430f34322202b73aa392431b5c2c49e15304fb255bb24c540366

SHA512
a4e353fcb78579345d4c5bc1f48970b473e0499dfe5bc6abeffb669295fa2940ce8637045a11f881fe88dd9b97d380ae9a8eed1b94fbd47181e0b4eb427e9679

Download Submit
\Users\Public\Microsoft Build\Isass.exe
Filesize
211KB

MD5
ae4658242d9320e6d4d01e336e3eeba1

SHA1
488966261209c9aea402256516aa8c76d9dd7712

SHA256
102fdd119ce1ddda358dd45b7c2bce2f5064d4db05a8005cfdbc9b83fb622548

SHA512
2cfe782c8920ad5ed42ca88d825c3245ce0220a604667fdce2d33e98690c7faa45572cfde81e77388253e98afcebc8ef51d29c22e8f4b2c3f845de2e5326c4df

Download Submit
memory/2104-52-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-30-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-31-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-18-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2104-81-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-34-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-72-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-71-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-59-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-58-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-93-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-80-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-43-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-42-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-35-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-51-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2104-15-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2372-8-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2372-13-0x0000000004620000-0x00000000058C8000-memory.dmp

Filesize
18.7MB

Download
memory/2372-17-0x0000000004C20000-0x0000000005EC8000-memory.dmp

Filesize
18.7MB

Download
memory/2372-16-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2636-22-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2692-29-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2772-19-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads