2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde

General

Target

2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
Size

780KB
MD5

40a7b9912a261b2ac7d53c760d100d03
SHA1

c704873d747d0cce12a547dba10eb4c05937a2f6
SHA256

2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde
SHA512

b50ee543a260f82623737f6562061cee73522e242835931dcb55245eb31580e75e014e2add6448db10ddf24b4fa6b7f9efbf80d07913eb6ad8796fdbbdb0e9f1
SSDEEP

6144:/rTfUHeeSKOS9ccFKk3Y9t9YZL5Yz1MpA5ns/hCvYlaEhIlIAuVD61/zqr5QeP5T:/n8yN0Mr8ZL5I1z5nECMzA1qrN1S6D

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 27 IoCs

resource	yara_rule
behavioral2/files/0x000900000002340a-2.dat	UPX
behavioral2/memory/3444-4-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-7-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3444-6-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/60-9-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/2348-12-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/60-11-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/2348-14-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3880-15-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/1948-17-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/5040-28-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-29-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-30-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-33-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-34-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/files/0x0001000000022767-35.dat	UPX
behavioral2/memory/3224-38-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-39-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-47-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-48-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-54-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-55-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-66-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-67-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-78-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-79-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX
behavioral2/memory/3224-88-0x0000000000400000-0x00000000016A8E52-memory.dmp	UPX

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Isass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Isass.exe

Executes dropped EXE 5 IoCs

pid	Process
3224	Isass.exe
60	Isass.exe
3880	Isass.exe
5040	Isass.exe
5096	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3444	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
3444	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
3224	Isass.exe
3224	Isass.exe
60	Isass.exe
60	Isass.exe
60	Isass.exe
60	Isass.exe
60	Isass.exe
60	Isass.exe
2348	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
2348	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
3880	Isass.exe
3880	Isass.exe
3880	Isass.exe
3880	Isass.exe
3880	Isass.exe
3880	Isass.exe
1948	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
1948	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
5040	Isass.exe
5040	Isass.exe
5040	Isass.exe
5040	Isass.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3224	3444	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	82
PID 3444 wrote to memory of 3224	3444	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	82
PID 3444 wrote to memory of 3224	3444	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	82
PID 3444 wrote to memory of 60	3444	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	83
PID 3444 wrote to memory of 60	3444	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	83
PID 3444 wrote to memory of 60	3444	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	83
PID 60 wrote to memory of 2348	60	Isass.exe	84
PID 60 wrote to memory of 2348	60	Isass.exe	84
PID 60 wrote to memory of 2348	60	Isass.exe	84
PID 2348 wrote to memory of 3880	2348	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	85
PID 2348 wrote to memory of 3880	2348	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	85
PID 2348 wrote to memory of 3880	2348	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	85
PID 3880 wrote to memory of 1948	3880	Isass.exe	87
PID 3880 wrote to memory of 1948	3880	Isass.exe	87
PID 3880 wrote to memory of 1948	3880	Isass.exe	87
PID 1948 wrote to memory of 5040	1948	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	88
PID 1948 wrote to memory of 5040	1948	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	88
PID 1948 wrote to memory of 5040	1948	2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe	88
PID 5040 wrote to memory of 5096	5040	Isass.exe	90
PID 5040 wrote to memory of 5096	5040	Isass.exe	90

C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
"C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Public\Microsoft Build\Isass.exe
  "C:\Users\Public\Microsoft Build\Isass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Users\Public\Microsoft Build\Isass.exe
  "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
    "C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe"
        5⤵
        Checks computer location settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1948
      - C:\Users\Public\Microsoft Build\Isass.exe
        
        "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe"
        7⤵
        Executes dropped EXE
        
        PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe

Filesize
700KB

MD5
cc7bbcb94fea460090294e422d4cdc72

SHA1
4840da71b8e1e5d835727d648725e8eef9b9d39a

SHA256
a566ea89703daeb048dfd2da7c5cc9f2cdffe1885271f5df463fe67dec6a2eb0

SHA512
991c05247441949aba165a96b83e91b1da87dcd8a6b1a9e3597196e1ee2e9e8fd32952dd3c79c808349ebd0cffc8e1e3fe013fc1982ea642e6b7b9f4caa2bf71

Download Submit
C:\Users\Admin\AppData\Local\Temp\2a63aad6a119cccc9747fa37e0045bdd5970d24a373838ac835f083951de0cde.exe

Filesize
524KB

MD5
645d5875c0ce2052d93943c62238a06e

SHA1
38c00dfaa6e0192e1157212d5baf42a8db869776

SHA256
66ef54018ef1207394bef76bcb0411f2fbbedd6230a812026bf8f1710218dbf9

SHA512
eb9654b527ddc15fae042ef6fa6b8a25f76c2fc21314abd1d629bac5066cfa11d9f3c1191150dc7784b20e5e47c4855ab97d34fadf904989a7a43ccd626949fe

Download Submit
C:\Users\Public\Microsoft Build\Isass.exe

Filesize
231KB

MD5
5962104167d78d905cd2680b38060e06

SHA1
fb9a26575697335236fc80d990ed30e7600420de

SHA256
8272850eba5c045f8fa2d7df28149ffd0c26a9739d1757d0a5aae53b854cc5ae

SHA512
3d222c573e04ba5cbac7ff51c84a3d00eb6e753fbcc24c6c63bdb8afd5134d5a4a33d989093a96d66f01dad60f3eb70082b934e928682fd65624e7d68e3348e3

Download Submit
memory/60-9-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/60-11-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/1948-17-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2348-14-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/2348-12-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-30-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-39-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-88-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-8-0x0000000001B50000-0x0000000001B51000-memory.dmp

Filesize
4KB

Download
memory/3224-79-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-29-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-7-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-33-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-34-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-78-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-38-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-67-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-47-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-48-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-54-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-55-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3224-66-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3444-4-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3444-6-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/3880-15-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download
memory/5040-28-0x0000000000400000-0x00000000016A8E52-memory.dmp

Filesize
18.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads