2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde

General

Target

2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
Size

780KB
MD5

40a7b9912a261b2ac7d53c760d100d03
SHA1

c704873d747d0cce12a547dba10eb4c05937a2f6
SHA256

2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde
SHA512

b50ee543a260f82623737f6562061cee73522e242835931dcb55245eb31580e75e014e2add6448db10ddf24b4fa6b7f9efbf80d07913eb6ad8796fdbbdb0e9f1
SSDEEP

6144:/rTfUHeeSKOS9ccFKk3Y9t9YZL5Yz1MpA5ns/hCvYlaEhIlIAuVD61/zqr5QeP5T:/n8yN0Mr8ZL5I1z5nECMzA1qrN1S6D

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 20 IoCs

resource	yara_rule
behavioral1/files/0x002f000000015cfd-1.dat	UPX
behavioral1/memory/276-14-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/3008-11-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/3008-13-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/2268-20-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-23-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-24-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-27-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-28-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-35-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-36-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-44-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-45-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-51-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-52-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-64-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-65-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-73-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-74-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral1/memory/276-86-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX

Executes dropped EXE 3 IoCs

pid	Process
276	Isass.exe
2268	Isass.exe
2752	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe

Loads dropped DLL 7 IoCs

pid	Process
3008	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
3008	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
3008	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
3008	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
2268	Isass.exe
2636	Process not Found
276	Isass.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3008	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
276	Isass.exe
2268	Isass.exe
2268	Isass.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 276	3008	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	28
PID 3008 wrote to memory of 276	3008	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	28
PID 3008 wrote to memory of 276	3008	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	28
PID 3008 wrote to memory of 276	3008	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	28
PID 3008 wrote to memory of 2268	3008	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	29
PID 3008 wrote to memory of 2268	3008	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	29
PID 3008 wrote to memory of 2268	3008	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	29
PID 3008 wrote to memory of 2268	3008	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	29
PID 2268 wrote to memory of 2752	2268	Isass.exe	30
PID 2268 wrote to memory of 2752	2268	Isass.exe	30
PID 2268 wrote to memory of 2752	2268	Isass.exe	30
PID 2268 wrote to memory of 2752	2268	Isass.exe	30

C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
"C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Public\Microsoft Build\Isass.exe
  "C:\Users\Public\Microsoft Build\Isass.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:276
- C:\Users\Public\Microsoft Build\Isass.exe
  "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
    "C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe"
    3⤵
    - Executes dropped EXE
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe

Filesize
524KB

MD5
645d5875c0ce2052d93943c62238a06e

SHA1
38c00dfaa6e0192e1157212d5baf42a8db869776

SHA256
66ef54018ef1207394bef76bcb0411f2fbbedd6230a812026bf8f1710218dbf9

SHA512
eb9654b527ddc15fae042ef6fa6b8a25f76c2fc21314abd1d629bac5066cfa11d9f3c1191150dc7784b20e5e47c4855ab97d34fadf904989a7a43ccd626949fe

Download Submit
\Users\Public\Microsoft Build\Isass.exe

Filesize
231KB

MD5
5962104167d78d905cd2680b38060e06

SHA1
fb9a26575697335236fc80d990ed30e7600420de

SHA256
8272850eba5c045f8fa2d7df28149ffd0c26a9739d1757d0a5aae53b854cc5ae

SHA512
3d222c573e04ba5cbac7ff51c84a3d00eb6e753fbcc24c6c63bdb8afd5134d5a4a33d989093a96d66f01dad60f3eb70082b934e928682fd65624e7d68e3348e3

Download Submit
memory/276-28-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-35-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-86-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-74-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-73-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-23-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-24-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-27-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-14-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-15-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/276-36-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-44-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-45-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-51-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-52-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-64-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/276-65-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2268-20-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3008-11-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3008-13-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads