02470c648e831159e369502544277fec357521855625e5de82239260214f1597

General

Target

02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
Size

419KB
MD5

9da609afb72697a8cf25ef188e0127c0
SHA1

ec93c637341dc141958c13c6eea7e8f92a8b0b5c
SHA256

02470c648e831159e369502544277fec357521855625e5de82239260214f1597
SHA512

9a14a6e171baa34b97ec391701aef8b326b6e88e4b632f9328606a2e7fe5db9f0a7277d7f3f59df822c45d59f11e43946689c48aa2e88c21566db2bbf1f8903f
SSDEEP

12288:/n8yN0Mr8ZYno0jIu5fZ1NbrfrSeQ41Q4PSkSgVKBuA:vPuZYo08u5fZ1NbrfrSeQ41Q4PSkSFBb

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 20 IoCs

resource	yara_rule
behavioral1/files/0x003400000001471d-1.dat	UPX
behavioral1/memory/2104-11-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-16-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2104-14-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2840-22-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-26-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-27-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-30-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-31-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-38-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-39-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-47-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-48-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-54-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-55-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-66-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-67-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-75-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-76-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/908-88-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX

Executes dropped EXE 3 IoCs

pid	Process
908	Isass.exe
2840	Isass.exe
2640	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe

Loads dropped DLL 6 IoCs

pid	Process
2104	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
2104	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
2104	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
2104	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
2840	Isass.exe
908	Isass.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2104	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
908	Isass.exe
2840	Isass.exe
2840	Isass.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 908	2104	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	28
PID 2104 wrote to memory of 908	2104	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	28
PID 2104 wrote to memory of 908	2104	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	28
PID 2104 wrote to memory of 908	2104	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	28
PID 2104 wrote to memory of 2840	2104	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	29
PID 2104 wrote to memory of 2840	2104	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	29
PID 2104 wrote to memory of 2840	2104	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	29
PID 2104 wrote to memory of 2840	2104	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	29
PID 2840 wrote to memory of 2640	2840	Isass.exe	30
PID 2840 wrote to memory of 2640	2840	Isass.exe	30
PID 2840 wrote to memory of 2640	2840	Isass.exe	30
PID 2840 wrote to memory of 2640	2840	Isass.exe	30

C:\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
"C:\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Public\Microsoft Build\Isass.exe
  "C:\Users\Public\Microsoft Build\Isass.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:908
- C:\Users\Public\Microsoft Build\Isass.exe
  "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
    "C:\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe"
    3⤵
    - Executes dropped EXE
    PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe

Filesize
140KB

MD5
af6d4428fb42903b1578b31bd333bf16

SHA1
c0d52a608a428397140a772920b9c3ea627c2cf3

SHA256
52090bc03a83c42081d6c6329874bb6a0701adecc07499a86c59a0fa831ff0e4

SHA512
eaae4756d133631aa476363ef8aaed30520088769702264e64c1f1acfc0cd880e3145158940edc4b7930ff5b2fd524bb6663a48c4420c7b8432d9843baa0e71a

Download Submit
\Users\Public\Microsoft Build\Isass.exe

Filesize
216KB

MD5
15d9f19d809805e00dc3fe34f5644f60

SHA1
e748c77822e46bec4fa95ae7386c9e98e72621e5

SHA256
0843071e7da799f70b16c43717e1ec69609b866d18170627f5a34603bd4cb08e

SHA512
c9b1c68be7f5f2fad76c6f07843614479b89ae2e605d6207d20d7edff5a7bba8ce156f464a466bfba653f930e4bb6d912131322e1f1898d90f0f45dd9aaf0711

Download Submit
memory/908-31-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-55-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-38-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-76-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-75-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-67-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-66-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-26-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-39-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-30-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-88-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-16-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-27-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-47-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-48-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-54-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/908-17-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2104-13-0x00000000043B0000-0x0000000005659000-memory.dmp

Filesize
18.7MB

Download
memory/2104-14-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2104-11-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2640-25-0x00000000003A0000-0x00000000003C8000-memory.dmp

Filesize
160KB

Download
memory/2840-22-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads