2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573

General

Target

2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
Size

316KB
MD5

7a983e05228617eb59e2583a99c011f0
SHA1

a76c01acb530654e3c2007d6ab56361fea06773f
SHA256

2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573
SHA512

ee76d466a474364c9692878236ec9c6e86c44af7192f25efeded774993a9c932853caca44c24974cedd5bc55a9d97b5f15a9fd06e05418ae4aa9037bc14d54f9
SSDEEP

6144:9rTfUHeeSKOS9ccFKk3Y9t9YTcPeLFZhTgp:9n8yN0Mr8TcPehrMp

Score

9^/10

persistence spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 25 IoCs

Processes:

resource	yara_rule
C:\Users\Public\Microsoft Build\Isass.exe	UPX
behavioral2/memory/4180-4-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/4180-6-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/2160-7-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/348-9-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/348-10-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/920-12-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/920-13-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1304-15-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/1304-25-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/2160-26-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/2160-29-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/2160-31-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe	UPX
behavioral2/memory/2160-35-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/2160-36-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/2160-44-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/2160-45-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/2160-51-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/2160-52-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/2160-63-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/2160-64-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/2160-75-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/2160-76-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX
behavioral2/memory/2160-85-0x0000000000400000-0x00000000016A8000-memory.dmp	UPX

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Isass.exe2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exeIsass.exe2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe

Executes dropped EXE 4 IoCs

Processes:

Isass.exeIsass.exeIsass.exe2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe

pid process

2160 Isass.exe
348 Isass.exe
1304 Isass.exe
4192 2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2160	Isass.exe
348	Isass.exe
1304	Isass.exe
4192	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exeIsass.exeIsass.exe2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exeIsass.exe

pid	process
4180	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
4180	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
2160	Isass.exe
2160	Isass.exe
348	Isass.exe
348	Isass.exe
348	Isass.exe
348	Isass.exe
348	Isass.exe
348	Isass.exe
920	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
920	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
1304	Isass.exe
1304	Isass.exe
1304	Isass.exe
1304	Isass.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exeIsass.exe2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exeIsass.exe

description	pid	process	target process
PID 4180 wrote to memory of 2160	4180	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 4180 wrote to memory of 2160	4180	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 4180 wrote to memory of 2160	4180	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 4180 wrote to memory of 348	4180	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 4180 wrote to memory of 348	4180	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 4180 wrote to memory of 348	4180	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 348 wrote to memory of 920	348	Isass.exe	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
PID 348 wrote to memory of 920	348	Isass.exe	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
PID 348 wrote to memory of 920	348	Isass.exe	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
PID 920 wrote to memory of 1304	920	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 920 wrote to memory of 1304	920	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 920 wrote to memory of 1304	920	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe	Isass.exe
PID 1304 wrote to memory of 4192	1304	Isass.exe	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
PID 1304 wrote to memory of 4192	1304	Isass.exe	2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe

C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
"C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4180

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2160

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:348

C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
"C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe"
3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:920

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1304

C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
"C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe"
5⤵
- Executes dropped EXE
PID:4192

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
Filesize
730KB

MD5
ae6c7b9286a847459743b88513e8637d

SHA1
0600c101e6262d18877724103b7e2d5b9cffe8de

SHA256
cb03bc239a5b104ba71c6483485af5b8a8d3c314894fecd9ccfbdfbc1c9bfeea

SHA512
68d611304acec40c1a917cb33077b954c75671e8422598cc01b49d5b991bfc7760a68c5bd83632443c60e19c07c3ab7aa8df04f8d0f2f50e41965c10ce462dd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2a79a215c4062fcdba530ef193c18671f38c5e2f87bc55270e77f8621dbf3573.exe
Filesize
99KB

MD5
af88cab288e8213a11a7ea5313363d31

SHA1
cb769e3246d5244a0040621e919f7c519ba49986

SHA256
7407fac6e170430f34322202b73aa392431b5c2c49e15304fb255bb24c540366

SHA512
a4e353fcb78579345d4c5bc1f48970b473e0499dfe5bc6abeffb669295fa2940ce8637045a11f881fe88dd9b97d380ae9a8eed1b94fbd47181e0b4eb427e9679

Download Submit
C:\Users\Public\Microsoft Build\Isass.exe
Filesize
211KB

MD5
ae4658242d9320e6d4d01e336e3eeba1

SHA1
488966261209c9aea402256516aa8c76d9dd7712

SHA256
102fdd119ce1ddda358dd45b7c2bce2f5064d4db05a8005cfdbc9b83fb622548

SHA512
2cfe782c8920ad5ed42ca88d825c3245ce0220a604667fdce2d33e98690c7faa45572cfde81e77388253e98afcebc8ef51d29c22e8f4b2c3f845de2e5326c4df

Download Submit
memory/348-9-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/348-10-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/920-30-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/920-12-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/920-13-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1304-25-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/1304-15-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-51-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-44-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-26-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-29-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-8-0x0000000001A60000-0x0000000001A61000-memory.dmp

Filesize
4KB

Download
memory/2160-31-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-85-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-35-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-36-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-76-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-45-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-7-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-52-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-63-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-64-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/2160-75-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4180-6-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4180-4-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads