8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d

General

Target

8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
Size

907KB
MD5

6d73f4e1865dc9293379d2f0b196c2cd
SHA1

3232a0ebd4c0028a56b3a3723c973dbc77463a6a
SHA256

8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d
SHA512

af91ac9e18fad80899432960bcd378f9b463999b9ef0535d6bced6acd1bb09de1d9746e75d64b475a7a9355681049a6ad3b1091e7ee1f1bc4fd0ce5f22802b91
SSDEEP

12288:/n8yN0Mr8ZX6aVArIygU40vy3W/ceKSHMsiFyY6XNdYKre0dhccHogYisTQQkNnk:vPuZXz0fDjymk4HM5yJ5dhLzYis0Nnk

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 22 IoCs

Processes:

resource	yara_rule
\Users\Public\Microsoft Build\Isass.exe	UPX
behavioral1/memory/1876-8-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/1876-13-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-16-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2480-18-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2696-28-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2764-20-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-79-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-80-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-83-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-84-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-88-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-92-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-100-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-101-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-107-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-108-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-116-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-117-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-129-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-130-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2380-143-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX

Executes dropped EXE 5 IoCs

Processes:

Isass.exeIsass.exeIsass.exe8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe

pid	process
2380	Isass.exe
2480	Isass.exe
2696	Isass.exe
2824	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
2832	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe

Loads dropped DLL 11 IoCs

Processes:

8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exeIsass.exe8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exeIsass.exe

pid	process
1876	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
1876	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
1876	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
1876	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
2764	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
2696	Isass.exe
2824	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
2832	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
2380	Isass.exe
2380	Isass.exe
2380	Isass.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exeIsass.exeIsass.exe8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exeIsass.exe

pid	process
1876	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
2380	Isass.exe
2480	Isass.exe
2480	Isass.exe
2480	Isass.exe
2764	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
2696	Isass.exe
2696	Isass.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exeIsass.exe8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exeIsass.exe8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe

description	pid	process	target process
PID 1876 wrote to memory of 2380	1876	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	Isass.exe
PID 1876 wrote to memory of 2380	1876	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	Isass.exe
PID 1876 wrote to memory of 2380	1876	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	Isass.exe
PID 1876 wrote to memory of 2380	1876	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	Isass.exe
PID 1876 wrote to memory of 2480	1876	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	Isass.exe
PID 1876 wrote to memory of 2480	1876	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	Isass.exe
PID 1876 wrote to memory of 2480	1876	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	Isass.exe
PID 1876 wrote to memory of 2480	1876	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	Isass.exe
PID 2480 wrote to memory of 2764	2480	Isass.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2480 wrote to memory of 2764	2480	Isass.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2480 wrote to memory of 2764	2480	Isass.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2480 wrote to memory of 2764	2480	Isass.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2764 wrote to memory of 2696	2764	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	Isass.exe
PID 2764 wrote to memory of 2696	2764	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	Isass.exe
PID 2764 wrote to memory of 2696	2764	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	Isass.exe
PID 2764 wrote to memory of 2696	2764	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	Isass.exe
PID 2696 wrote to memory of 2824	2696	Isass.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2696 wrote to memory of 2824	2696	Isass.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2696 wrote to memory of 2824	2696	Isass.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2696 wrote to memory of 2824	2696	Isass.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2696 wrote to memory of 2824	2696	Isass.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2696 wrote to memory of 2824	2696	Isass.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2696 wrote to memory of 2824	2696	Isass.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2824 wrote to memory of 2832	2824	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2824 wrote to memory of 2832	2824	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2824 wrote to memory of 2832	2824	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2824 wrote to memory of 2832	2824	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2824 wrote to memory of 2832	2824	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2824 wrote to memory of 2832	2824	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
PID 2824 wrote to memory of 2832	2824	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe	8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe

C:\Users\Admin\AppData\Local\Temp\8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
"C:\Users\Admin\AppData\Local\Temp\8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2380

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2480

C:\Users\Admin\AppData\Local\Temp\8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
"C:\Users\Admin\AppData\Local\Temp\8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764

C:\Users\Public\Microsoft Build\Isass.exe
"C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2696

C:\Users\Admin\AppData\Local\Temp\8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
"C:\Users\Admin\AppData\Local\Temp\8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824

C:\Windows\Temp\{55A7F6B1-BD14-4C98-956C-26CD31A68EDB}\.cr\8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe
"C:\Windows\Temp\{55A7F6B1-BD14-4C98-956C-26CD31A68EDB}\.cr\8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{513A899B-3189-447A-BF78-A4DF182B1900}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
\Users\Admin\AppData\Local\Temp\8dcaaa33b56f401370934f9ab6a758aeadc70fd40767e5d1b92029d49946235d.exe

Filesize
635KB

MD5
b73be38096eddc4d427fbbfdd8cf15bd

SHA1
534f605fd43cc7089e448e5fa1b1a2d56de14779

SHA256
ab1164dcaf6c7d7d4905881f332a7b6f854be46e36b860c44d9eedc96ab6607a

SHA512
5af779926d344bc7c4140725f90cddad5eb778f5ca4856d5a31a6084424964d205638815eab4454e0ea34ea56fafca19fadd1eb2779dc6b7f277e4e4ce4b1603

Download Submit
\Users\Public\Microsoft Build\Isass.exe

Filesize
216KB

MD5
4f9a8fc4c9fd40fb8e9f52ab742a0ac3

SHA1
7fbd9e9a7693cf5a379f93095d2728c5d0f5adad

SHA256
eaa8a218bfd228b3f5944f89eece8a5e96377cc7d0e880327771baaeeefca828

SHA512
03ed7fae3e510422b76dfde88e2ae097b66059756d34cf1fd22f56aca0626c964ce5b8e4b028f06002d01abfb0c5c47fd006f03813f8ce782468da116d674f44

Download Submit
\Windows\Temp\{513A899B-3189-447A-BF78-A4DF182B1900}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
memory/1876-8-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1876-15-0x0000000004670000-0x0000000005919000-memory.dmp

Filesize
18.7MB

Download
memory/1876-10-0x0000000004670000-0x0000000005919000-memory.dmp

Filesize
18.7MB

Download
memory/1876-13-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-107-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-88-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-143-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-16-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-130-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-79-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-80-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-83-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-84-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-129-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-92-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-100-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-101-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-17-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2380-108-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-116-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2380-117-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2480-18-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2696-28-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2764-20-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads