isrstealer | cbf4704f11c6d4a57c374d2333f76eacef1d8ed7929a1af1f43ed4e5eaabf958

Analysis

max time kernel
150s
max time network
134s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-10-2024 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

216ca65ab4e45f62e1feb9ec72cadaf0_JaffaCakes118.exe
Size

1.5MB
MD5

216ca65ab4e45f62e1feb9ec72cadaf0
SHA1

4c15261de134999b8ddc318886057fb4ea7517e6
SHA256

cbf4704f11c6d4a57c374d2333f76eacef1d8ed7929a1af1f43ed4e5eaabf958
SHA512

62dfea4e8b38802c9163fddc92904fcfaad70a05310433ec55c6e4d69d014a086f981756d415aeaa9540b399b00b82cc19db096cf563e8045fb986e38fe1694f
SSDEEP

24576:NKoFi8yx1uJVsxu/XvcAcb5UPWbApAQCVZPkTfvAGBQDQYr2bs:NKiiPx1oVsUfcVFU+bApqVebHBQsYC

Score

10^/10

isrstealer collection discovery persistence stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/2276-36-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral1/memory/2276-51-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral1/memory/2276-52-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/2708-50-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/2708-50-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Executes dropped EXE 2 IoCs

pid	Process
2320	RHPIBA~1.EXE
1920	WhTX.exe

Loads dropped DLL 4 IoCs

pid	Process
2508	216ca65ab4e45f62e1feb9ec72cadaf0_JaffaCakes118.exe
2320	RHPIBA~1.EXE
2320	RHPIBA~1.EXE
1920	WhTX.exe

Accesses Microsoft Outlook accounts 1 TTPs 12 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	216ca65ab4e45f62e1feb9ec72cadaf0_JaffaCakes118.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0008000000018741-2.dat	autoit_exe

Suspicious use of SetThreadContext 44 IoCs

description	pid	Process	procid_target
PID 1920 set thread context of 2276	1920	WhTX.exe	33
PID 2276 set thread context of 2784	2276	RegSvcs.exe	34
PID 2276 set thread context of 2708	2276	RegSvcs.exe	36
PID 1920 set thread context of 2560	1920	WhTX.exe	37
PID 2560 set thread context of 1248	2560	RegSvcs.exe	38
PID 2560 set thread context of 2876	2560	RegSvcs.exe	39
PID 1920 set thread context of 2776	1920	WhTX.exe	41
PID 2776 set thread context of 1952	2776	RegSvcs.exe	42
PID 2776 set thread context of 1824	2776	RegSvcs.exe	43
PID 1920 set thread context of 1648	1920	WhTX.exe	44
PID 1648 set thread context of 1916	1648	RegSvcs.exe	45
PID 1648 set thread context of 2220	1648	RegSvcs.exe	46
PID 1920 set thread context of 968	1920	WhTX.exe	48
PID 968 set thread context of 1112	968	RegSvcs.exe	49
PID 968 set thread context of 2528	968	RegSvcs.exe	50
PID 1920 set thread context of 1984	1920	WhTX.exe	52
PID 1984 set thread context of 1352	1984	RegSvcs.exe	53
PID 1984 set thread context of 3012	1984	RegSvcs.exe	54
PID 1920 set thread context of 1316	1920	WhTX.exe	56
PID 1316 set thread context of 896	1316	RegSvcs.exe	57
PID 1316 set thread context of 592	1316	RegSvcs.exe	58
PID 1920 set thread context of 2736	1920	WhTX.exe	60
PID 2736 set thread context of 2684	2736	RegSvcs.exe	61
PID 2736 set thread context of 2716	2736	RegSvcs.exe	62
PID 1920 set thread context of 2752	1920	WhTX.exe	64
PID 2752 set thread context of 2576	2752	RegSvcs.exe	65
PID 2752 set thread context of 1096	2752	RegSvcs.exe	66
PID 1920 set thread context of 1708	1920	WhTX.exe	68
PID 1708 set thread context of 2724	1708	RegSvcs.exe	69
PID 1708 set thread context of 2532	1708	RegSvcs.exe	70
PID 1920 set thread context of 2912	1920	WhTX.exe	72
PID 2912 set thread context of 1716	2912	RegSvcs.exe	73
PID 2912 set thread context of 1088	2912	RegSvcs.exe	74
PID 1920 set thread context of 1728	1920	WhTX.exe	76
PID 1728 set thread context of 1980	1728	RegSvcs.exe	77
PID 1728 set thread context of 1704	1728	RegSvcs.exe	78
PID 1920 set thread context of 912	1920	WhTX.exe	80
PID 912 set thread context of 2012	912	RegSvcs.exe	81
PID 912 set thread context of 1992	912	RegSvcs.exe	82
PID 1920 set thread context of 904	1920	WhTX.exe	84
PID 904 set thread context of 316	904	RegSvcs.exe	85
PID 904 set thread context of 1792	904	RegSvcs.exe	86
PID 1920 set thread context of 1620	1920	WhTX.exe	87
PID 1620 set thread context of 2460	1620	RegSvcs.exe	88

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2784-41-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2784-42-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2784-43-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2784-44-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2708-47-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2708-48-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2708-49-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2708-50-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1248-61-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1248-62-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1248-63-0x0000000000400000-0x0000000000453000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	216ca65ab4e45f62e1feb9ec72cadaf0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WhTX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RHPIBA~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2320	RHPIBA~1.EXE
2320	RHPIBA~1.EXE
2320	RHPIBA~1.EXE
2320	RHPIBA~1.EXE
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe
1920	WhTX.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2276	RegSvcs.exe
2560	RegSvcs.exe
2776	RegSvcs.exe
1648	RegSvcs.exe
968	RegSvcs.exe
1984	RegSvcs.exe
1316	RegSvcs.exe
2736	RegSvcs.exe
2752	RegSvcs.exe
1708	RegSvcs.exe
2912	RegSvcs.exe
1728	RegSvcs.exe
912	RegSvcs.exe
904	RegSvcs.exe
1620	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2320	2508	216ca65ab4e45f62e1feb9ec72cadaf0_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2320	2508	216ca65ab4e45f62e1feb9ec72cadaf0_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2320	2508	216ca65ab4e45f62e1feb9ec72cadaf0_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2320	2508	216ca65ab4e45f62e1feb9ec72cadaf0_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2320	2508	216ca65ab4e45f62e1feb9ec72cadaf0_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2320	2508	216ca65ab4e45f62e1feb9ec72cadaf0_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2320	2508	216ca65ab4e45f62e1feb9ec72cadaf0_JaffaCakes118.exe	31
PID 2320 wrote to memory of 1920	2320	RHPIBA~1.EXE	32
PID 2320 wrote to memory of 1920	2320	RHPIBA~1.EXE	32
PID 2320 wrote to memory of 1920	2320	RHPIBA~1.EXE	32
PID 2320 wrote to memory of 1920	2320	RHPIBA~1.EXE	32
PID 2320 wrote to memory of 1920	2320	RHPIBA~1.EXE	32
PID 2320 wrote to memory of 1920	2320	RHPIBA~1.EXE	32
PID 2320 wrote to memory of 1920	2320	RHPIBA~1.EXE	32
PID 1920 wrote to memory of 2276	1920	WhTX.exe	33
PID 1920 wrote to memory of 2276	1920	WhTX.exe	33
PID 1920 wrote to memory of 2276	1920	WhTX.exe	33
PID 1920 wrote to memory of 2276	1920	WhTX.exe	33
PID 1920 wrote to memory of 2276	1920	WhTX.exe	33
PID 1920 wrote to memory of 2276	1920	WhTX.exe	33
PID 1920 wrote to memory of 2276	1920	WhTX.exe	33
PID 1920 wrote to memory of 2276	1920	WhTX.exe	33
PID 1920 wrote to memory of 2276	1920	WhTX.exe	33
PID 2276 wrote to memory of 2784	2276	RegSvcs.exe	34
PID 2276 wrote to memory of 2784	2276	RegSvcs.exe	34
PID 2276 wrote to memory of 2784	2276	RegSvcs.exe	34
PID 2276 wrote to memory of 2784	2276	RegSvcs.exe	34
PID 2276 wrote to memory of 2784	2276	RegSvcs.exe	34
PID 2276 wrote to memory of 2784	2276	RegSvcs.exe	34
PID 2276 wrote to memory of 2784	2276	RegSvcs.exe	34
PID 2276 wrote to memory of 2784	2276	RegSvcs.exe	34
PID 2276 wrote to memory of 2784	2276	RegSvcs.exe	34
PID 2276 wrote to memory of 2784	2276	RegSvcs.exe	34
PID 2276 wrote to memory of 2784	2276	RegSvcs.exe	34
PID 2276 wrote to memory of 2784	2276	RegSvcs.exe	34
PID 2276 wrote to memory of 2708	2276	RegSvcs.exe	36
PID 2276 wrote to memory of 2708	2276	RegSvcs.exe	36
PID 2276 wrote to memory of 2708	2276	RegSvcs.exe	36
PID 2276 wrote to memory of 2708	2276	RegSvcs.exe	36
PID 2276 wrote to memory of 2708	2276	RegSvcs.exe	36
PID 2276 wrote to memory of 2708	2276	RegSvcs.exe	36
PID 2276 wrote to memory of 2708	2276	RegSvcs.exe	36
PID 2276 wrote to memory of 2708	2276	RegSvcs.exe	36
PID 2276 wrote to memory of 2708	2276	RegSvcs.exe	36
PID 2276 wrote to memory of 2708	2276	RegSvcs.exe	36
PID 2276 wrote to memory of 2708	2276	RegSvcs.exe	36
PID 2276 wrote to memory of 2708	2276	RegSvcs.exe	36
PID 1920 wrote to memory of 2560	1920	WhTX.exe	37
PID 1920 wrote to memory of 2560	1920	WhTX.exe	37
PID 1920 wrote to memory of 2560	1920	WhTX.exe	37
PID 1920 wrote to memory of 2560	1920	WhTX.exe	37
PID 1920 wrote to memory of 2560	1920	WhTX.exe	37
PID 1920 wrote to memory of 2560	1920	WhTX.exe	37
PID 1920 wrote to memory of 2560	1920	WhTX.exe	37
PID 1920 wrote to memory of 2560	1920	WhTX.exe	37
PID 1920 wrote to memory of 2560	1920	WhTX.exe	37
PID 2560 wrote to memory of 1248	2560	RegSvcs.exe	38
PID 2560 wrote to memory of 1248	2560	RegSvcs.exe	38
PID 2560 wrote to memory of 1248	2560	RegSvcs.exe	38
PID 2560 wrote to memory of 1248	2560	RegSvcs.exe	38
PID 2560 wrote to memory of 1248	2560	RegSvcs.exe	38
PID 2560 wrote to memory of 1248	2560	RegSvcs.exe	38
PID 2560 wrote to memory of 1248	2560	RegSvcs.exe	38
PID 2560 wrote to memory of 1248	2560	RegSvcs.exe	38

C:\Users\Admin\AppData\Local\Temp\216ca65ab4e45f62e1feb9ec72cadaf0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\216ca65ab4e45f62e1feb9ec72cadaf0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RHPIBA~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RHPIBA~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Users\Admin\AppData\Roaming\WhTX.exe
    "C:\Users\Admin\AppData\Roaming\WhTX.exe" "C:\Users\Admin\AppData\Roaming\iXZCO"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2276
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\cGaCHGkWDy.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\iNc6EbssUC.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2708
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\hN4GY8Ep0S.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1248
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\CaxI4nD2S0.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2876
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2776
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\M40ORaNnsU.ini"
        5⤵
        
        PID:1952
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\GqqXWsefmS.ini"
        5⤵
        
        PID:1824
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1648
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\j1x5gx697q.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\2n9B0BPQNx.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2220
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:968
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\NjtCZPF7zs.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1112
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\ttrv2EmiKm.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2528
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1984
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\g39eWqBasU.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1352
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\bETJEbjaYX.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:3012
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1316
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\FKXvLI3P5m.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:896
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\Z3picfu3EE.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:592
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2736
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\uzZkCukkqA.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\w0nPr1dPTZ.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2716
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\HwXQQGT65V.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\r7tqKDE6vY.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1096
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1708
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\Op7wBGjcmg.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2724
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\ARAHGfAZoA.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2532
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\Y2XYZEN69E.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\rQ2ElEFrFu.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1088
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1728
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\OA9cf8C0Dh.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\RVH6MmbvlE.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1704
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:912
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\ZgQNi3FQGc.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2012
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\s4u3t38BMI.ini"
        5⤵
        
        PID:1992
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:904
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\ot3mczPzPZ.ini"
        5⤵
        
        PID:316
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\mHaCzCUkgG.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1792
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\e1fqhtFtT3.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WhTX1

Filesize
915KB

MD5
4744edba858885bfe4d513e5ba6030ac

SHA1
7706ebc3097465571daf5bc0c26721a79e8b50c2

SHA256
b71c08e936ab72a27a822e2984a60e798591d2b71b352875f6aede464245724b

SHA512
14cf08f1227f320e36ed9b50de68fffea72393f59b921e81ad987f8cd19d9b3766f601063df474b99b6b948a8431232c900577ab633a3d8f13de0b2f69a36685

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iXZCO

Filesize
492KB

MD5
af639e2097d320f5f1ab120d810da850

SHA1
2bd6e743fd19ce4c581cc53ab91314d45abf6044

SHA256
9e46e54f04d7a8642419db4f3e6d891476d2e1ddd2c339a2e87f82d11be221cc

SHA512
e5ea9c6b372be020eafe33214d1bdcb12358dbe2f47f63ca70039c1863a588d78a233478bb3712ef7ad7228f84470ec9aec34b2d1f50429cf7931760d3effb1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\cGaCHGkWDy.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
C:\Users\Admin\AppData\Roaming\iXZCO

Filesize
369KB

MD5
3fcf27371696b46d07890a695f75f394

SHA1
bc58d4d7e64925b273acb91d9a15f9da62efc845

SHA256
9d0d58afacd8a5b08c2c8d0be5eee42f75d148d8de42b49914f8a390fbcf05ca

SHA512
06b5fc740bfe94520dbe349cb42e957cf0cd05c80224fb53b341b86d1eb101f6706fcd7234bbc06ce4ad8333010eab427685d5184031cb4e441de88d3929b896

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\RHPIBA~1.EXE

Filesize
1.8MB

MD5
98c4f8e6cbf337a38504887861d63714

SHA1
a8988859b8d4b976680ee35c3598289fefdbc875

SHA256
6441cf49b87dc4b5e43fcbbf20c12efef3ba2ad9aebc4fbe10ac22c341ea67f2

SHA512
d5c316b36360576dfbffb53f513c618bfadff33f670878ccb4f46f3965c8ca308e8843be6d5ef942f04eb31277ae63a830662e156afe323b88d90592850af8fd

Download Submit
\Users\Admin\AppData\Roaming\WhTX.exe

Filesize
915KB

MD5
b06e67f9767e5023892d9698703ad098

SHA1
acc07666f4c1d4461d3e1c263cf6a194a8dd1544

SHA256
8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb

SHA512
7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

Download Submit
memory/968-97-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1248-63-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1248-62-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1248-61-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1648-80-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2276-36-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2276-51-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2276-34-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2276-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2276-52-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2560-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2708-49-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2708-50-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2708-48-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2708-47-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2776-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2784-44-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2784-43-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2784-42-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2784-41-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download