02470c648e831159e369502544277fec357521855625e5de82239260214f1597

General

Target

02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
Size

419KB
MD5

9da609afb72697a8cf25ef188e0127c0
SHA1

ec93c637341dc141958c13c6eea7e8f92a8b0b5c
SHA256

02470c648e831159e369502544277fec357521855625e5de82239260214f1597
SHA512

9a14a6e171baa34b97ec391701aef8b326b6e88e4b632f9328606a2e7fe5db9f0a7277d7f3f59df822c45d59f11e43946689c48aa2e88c21566db2bbf1f8903f
SSDEEP

12288:/n8yN0Mr8ZYno0jIu5fZ1NbrfrSeQ41Q4PSkSgVKBuA:vPuZYo08u5fZ1NbrfrSeQ41Q4PSkSFBb

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 26 IoCs

resource	yara_rule
behavioral2/memory/2444-2-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/files/0x00080000000233f9-4.dat	UPX
behavioral2/memory/1588-5-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1052-8-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/2444-9-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1052-11-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/4416-12-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/4416-15-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/856-17-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/856-28-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1588-32-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1588-35-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1588-36-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1588-37-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/files/0x000100000002276b-38.dat	UPX
behavioral2/memory/1588-41-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1588-42-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1588-50-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1588-51-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1588-57-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1588-58-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1588-65-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1588-69-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1588-80-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1588-81-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1588-90-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Isass.exe

Executes dropped EXE 4 IoCs

pid	Process
1588	Isass.exe
1052	Isass.exe
856	Isass.exe
1616	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2444	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
2444	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
1588	Isass.exe
1588	Isass.exe
1052	Isass.exe
1052	Isass.exe
1052	Isass.exe
1052	Isass.exe
1052	Isass.exe
1052	Isass.exe
4416	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
4416	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
856	Isass.exe
856	Isass.exe
856	Isass.exe
856	Isass.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1588	2444	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	82
PID 2444 wrote to memory of 1588	2444	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	82
PID 2444 wrote to memory of 1588	2444	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	82
PID 2444 wrote to memory of 1052	2444	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	83
PID 2444 wrote to memory of 1052	2444	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	83
PID 2444 wrote to memory of 1052	2444	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	83
PID 1052 wrote to memory of 4416	1052	Isass.exe	85
PID 1052 wrote to memory of 4416	1052	Isass.exe	85
PID 1052 wrote to memory of 4416	1052	Isass.exe	85
PID 4416 wrote to memory of 856	4416	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	86
PID 4416 wrote to memory of 856	4416	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	86
PID 4416 wrote to memory of 856	4416	02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe	86
PID 856 wrote to memory of 1616	856	Isass.exe	89
PID 856 wrote to memory of 1616	856	Isass.exe	89

C:\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
"C:\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Public\Microsoft Build\Isass.exe
  "C:\Users\Public\Microsoft Build\Isass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1588
- C:\Users\Public\Microsoft Build\Isass.exe
  "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
    "C:\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:856
    - - C:\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe
        
        "C:\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe"
        5⤵
        Executes dropped EXE
        
        PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe

Filesize
696KB

MD5
ee972b406529ef9e24fef4cd1d02a207

SHA1
0c2f6d2dd9ab456432421b060ee04d50779a752e

SHA256
0b2afe2b2401e7f03badf15bbf8e87e6c4f8b67ee10c12ce032a0f721ccc5996

SHA512
58683b376264e65d1b596aa1764f901835a7e77ad760167f9a70ca8547c935c964b77cc189e5856b8e13f0d296abf4c60d278bddc1bed09b604ad4900c95394d

Download Submit
C:\Users\Admin\AppData\Local\Temp\02470c648e831159e369502544277fec357521855625e5de82239260214f1597.exe

Filesize
140KB

MD5
af6d4428fb42903b1578b31bd333bf16

SHA1
c0d52a608a428397140a772920b9c3ea627c2cf3

SHA256
52090bc03a83c42081d6c6329874bb6a0701adecc07499a86c59a0fa831ff0e4

SHA512
eaae4756d133631aa476363ef8aaed30520088769702264e64c1f1acfc0cd880e3145158940edc4b7930ff5b2fd524bb6663a48c4420c7b8432d9843baa0e71a

Download Submit
C:\Users\Public\Microsoft Build\Isass.exe

Filesize
216KB

MD5
15d9f19d809805e00dc3fe34f5644f60

SHA1
e748c77822e46bec4fa95ae7386c9e98e72621e5

SHA256
0843071e7da799f70b16c43717e1ec69609b866d18170627f5a34603bd4cb08e

SHA512
c9b1c68be7f5f2fad76c6f07843614479b89ae2e605d6207d20d7edff5a7bba8ce156f464a466bfba653f930e4bb6d912131322e1f1898d90f0f45dd9aaf0711

Download Submit
memory/856-17-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/856-28-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1052-8-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1052-11-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-51-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-41-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-90-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-81-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-10-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/1588-80-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-32-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-35-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-36-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-37-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-5-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-69-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-42-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-50-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-65-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-57-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1588-58-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1616-30-0x0000000000150000-0x0000000000178000-memory.dmp

Filesize
160KB

Download
memory/2444-2-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2444-9-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/4416-15-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/4416-12-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads