isrstealer | 8371ad57c9f598e7bad4e96b4c4e0749971cbe42cfd175b0b8dbedab90eb7bea

Analysis

max time kernel
141s
max time network
134s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 01:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DOCUMENT.exe
Size

941KB
MD5

752ce2568a7b41a0fcbbc5f417ffccc3
SHA1

864e7e6514a207df0b70066eecd6126becb1ff09
SHA256

7b6570a85ef1600456266810593fd5e2de186f34ed7868ace12148ec14f8812e
SHA512

70e58cde454e360df36784f48b2795a96d4f8fadc797d6667bff73a4b217518584177972398eaa5d12d082301ee8bd37c148d05b0da39ffb51b5da6650f84538
SSDEEP

12288:5at0EAH49n8B7CnN/j2+T0BWLkGLbWgNIwY6Cuw78YOJEn1GUEVQqYHQFOH9LPsN:It24RNj2+TGqkOhNSu68GGUEtsh7N10N

Score

10^/10

isrstealer collection discovery evasion persistence stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/2716-27-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

Isrstealer family
isrstealer

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	AcrbRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	AcrbRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	AcrbRd32.exe

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/1428-43-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/1684-69-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/2848-91-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1428-43-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral1/memory/1684-69-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral1/memory/2848-91-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Executes dropped EXE 4 IoCs

pid	Process
688	AcrbRd32.exe
2744	AcrbRd32.exe
2396	AcrbRd32.exe
768	AcrbRd32.exe

Loads dropped DLL 7 IoCs

pid	Process
2888	DOCUMENT.exe
2888	DOCUMENT.exe
2888	DOCUMENT.exe
2888	DOCUMENT.exe
2264	WScript.exe
2356	WScript.exe
2628	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\4zo2p4375w9716n = "C:\\Users\\Admin\\4zo2p4375w9716n\\79711.vbs"	AcrbRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\4zo2p4375w9716n = "C:\\Users\\Admin\\4zo2p4375w9716n\\79711.vbs"	AcrbRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\4zo2p4375w9716n = "C:\\Users\\Admin\\4zo2p4375w9716n\\79711.vbs"	AcrbRd32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AcrbRd32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AcrbRd32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AcrbRd32.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 688 set thread context of 2716	688	AcrbRd32.exe	32
PID 2716 set thread context of 2552	2716	RegSvcs.exe	33
PID 2716 set thread context of 1428	2716	RegSvcs.exe	34
PID 2744 set thread context of 2020	2744	AcrbRd32.exe	38
PID 2020 set thread context of 1924	2020	RegSvcs.exe	39
PID 2020 set thread context of 1684	2020	RegSvcs.exe	40
PID 2396 set thread context of 2944	2396	AcrbRd32.exe	44
PID 2944 set thread context of 2956	2944	RegSvcs.exe	45
PID 2944 set thread context of 2848	2944	RegSvcs.exe	46

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2552-32-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2552-33-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2552-34-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2552-35-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1428-40-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1428-42-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1428-43-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1428-41-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1924-59-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1924-60-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1924-61-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1684-67-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1684-69-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1684-68-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2956-81-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2956-82-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2956-83-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2848-90-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2848-89-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2848-91-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DOCUMENT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcrbRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcrbRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcrbRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcrbRd32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
688	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2744	AcrbRd32.exe
2396	AcrbRd32.exe
2396	AcrbRd32.exe
2396	AcrbRd32.exe
2396	AcrbRd32.exe
2396	AcrbRd32.exe
2396	AcrbRd32.exe
2396	AcrbRd32.exe
2396	AcrbRd32.exe
2396	AcrbRd32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	688	AcrbRd32.exe
Token: SeDebugPrivilege	2744	AcrbRd32.exe
Token: SeDebugPrivilege	2396	AcrbRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2716	RegSvcs.exe
2020	RegSvcs.exe
2944	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 688	2888	DOCUMENT.exe	30
PID 2888 wrote to memory of 688	2888	DOCUMENT.exe	30
PID 2888 wrote to memory of 688	2888	DOCUMENT.exe	30
PID 2888 wrote to memory of 688	2888	DOCUMENT.exe	30
PID 2888 wrote to memory of 688	2888	DOCUMENT.exe	30
PID 2888 wrote to memory of 688	2888	DOCUMENT.exe	30
PID 2888 wrote to memory of 688	2888	DOCUMENT.exe	30
PID 688 wrote to memory of 2716	688	AcrbRd32.exe	32
PID 688 wrote to memory of 2716	688	AcrbRd32.exe	32
PID 688 wrote to memory of 2716	688	AcrbRd32.exe	32
PID 688 wrote to memory of 2716	688	AcrbRd32.exe	32
PID 688 wrote to memory of 2716	688	AcrbRd32.exe	32
PID 688 wrote to memory of 2716	688	AcrbRd32.exe	32
PID 688 wrote to memory of 2716	688	AcrbRd32.exe	32
PID 688 wrote to memory of 2716	688	AcrbRd32.exe	32
PID 688 wrote to memory of 2716	688	AcrbRd32.exe	32
PID 2716 wrote to memory of 2552	2716	RegSvcs.exe	33
PID 2716 wrote to memory of 2552	2716	RegSvcs.exe	33
PID 2716 wrote to memory of 2552	2716	RegSvcs.exe	33
PID 2716 wrote to memory of 2552	2716	RegSvcs.exe	33
PID 2716 wrote to memory of 2552	2716	RegSvcs.exe	33
PID 2716 wrote to memory of 2552	2716	RegSvcs.exe	33
PID 2716 wrote to memory of 2552	2716	RegSvcs.exe	33
PID 2716 wrote to memory of 2552	2716	RegSvcs.exe	33
PID 2716 wrote to memory of 2552	2716	RegSvcs.exe	33
PID 2716 wrote to memory of 2552	2716	RegSvcs.exe	33
PID 2716 wrote to memory of 2552	2716	RegSvcs.exe	33
PID 2716 wrote to memory of 2552	2716	RegSvcs.exe	33
PID 2716 wrote to memory of 1428	2716	RegSvcs.exe	34
PID 2716 wrote to memory of 1428	2716	RegSvcs.exe	34
PID 2716 wrote to memory of 1428	2716	RegSvcs.exe	34
PID 2716 wrote to memory of 1428	2716	RegSvcs.exe	34
PID 2716 wrote to memory of 1428	2716	RegSvcs.exe	34
PID 2716 wrote to memory of 1428	2716	RegSvcs.exe	34
PID 2716 wrote to memory of 1428	2716	RegSvcs.exe	34
PID 2716 wrote to memory of 1428	2716	RegSvcs.exe	34
PID 2716 wrote to memory of 1428	2716	RegSvcs.exe	34
PID 2716 wrote to memory of 1428	2716	RegSvcs.exe	34
PID 2716 wrote to memory of 1428	2716	RegSvcs.exe	34
PID 2716 wrote to memory of 1428	2716	RegSvcs.exe	34
PID 688 wrote to memory of 2264	688	AcrbRd32.exe	36
PID 688 wrote to memory of 2264	688	AcrbRd32.exe	36
PID 688 wrote to memory of 2264	688	AcrbRd32.exe	36
PID 688 wrote to memory of 2264	688	AcrbRd32.exe	36
PID 688 wrote to memory of 2264	688	AcrbRd32.exe	36
PID 688 wrote to memory of 2264	688	AcrbRd32.exe	36
PID 688 wrote to memory of 2264	688	AcrbRd32.exe	36
PID 2264 wrote to memory of 2744	2264	WScript.exe	37
PID 2264 wrote to memory of 2744	2264	WScript.exe	37
PID 2264 wrote to memory of 2744	2264	WScript.exe	37
PID 2264 wrote to memory of 2744	2264	WScript.exe	37
PID 2264 wrote to memory of 2744	2264	WScript.exe	37
PID 2264 wrote to memory of 2744	2264	WScript.exe	37
PID 2264 wrote to memory of 2744	2264	WScript.exe	37
PID 2744 wrote to memory of 2020	2744	AcrbRd32.exe	38
PID 2744 wrote to memory of 2020	2744	AcrbRd32.exe	38
PID 2744 wrote to memory of 2020	2744	AcrbRd32.exe	38
PID 2744 wrote to memory of 2020	2744	AcrbRd32.exe	38
PID 2744 wrote to memory of 2020	2744	AcrbRd32.exe	38
PID 2744 wrote to memory of 2020	2744	AcrbRd32.exe	38
PID 2744 wrote to memory of 2020	2744	AcrbRd32.exe	38
PID 2744 wrote to memory of 2020	2744	AcrbRd32.exe	38
PID 2744 wrote to memory of 2020	2744	AcrbRd32.exe	38
PID 2020 wrote to memory of 1924	2020	RegSvcs.exe	39

C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
"C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AcrbRd32.exe
  "C:\Users\Admin\AcrbRd32.exe" qVyh.BVI
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      /scomma "C:\Users\Admin\AppData\Local\Temp\jNpg9diLcC.ini"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2552
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      /scomma "C:\Users\Admin\AppData\Local\Temp\IuEgIvL7tm.ini"
      4⤵
      Accesses Microsoft Outlook accounts
      System Location Discovery: System Language Discovery
      PID:1428
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\run.vbs"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Users\Admin\AcrbRd32.exe
      "C:\Users\Admin\AcrbRd32.exe" qVyh.BVI
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2020
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\XH8j8G7K1o.ini"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1924
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\bNdwxZSYHU.ini"
        6⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1684
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\run.vbs"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2356
      - C:\Users\Admin\AcrbRd32.exe
        
        "C:\Users\Admin\AcrbRd32.exe" qVyh.BVI
        6⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2396
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2944
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\NkpO14G49R.ini"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2956
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\IBZBDvyFMd.ini"
        8⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2848
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\run.vbs"
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2628
        
        C:\Users\Admin\AcrbRd32.exe
        
        "C:\Users\Admin\AcrbRd32.exe" qVyh.BVI
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jNpg9diLcC.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\start.lnk

Filesize
762B

MD5
9e6de45c2677f2d42aeeb5803c1615f5

SHA1
eb3890c29bff53114e87b2243a7bbed5a3f81ad8

SHA256
87270404a842beee65835cea037944c4f2d505dd1cc85504316e0e7d664941f0

SHA512
1e796eb59c44a3d639952635440589b8dbc8dffbe0114c1af40818d8b6f5655b5d4d792afb2501a693794a5a8f72add92c6b7cdc541f248a0ef8cf289a19fdad

Download Submit
C:\Users\Admin\fqNvzVucd.WFW

Filesize
176B

MD5
1228f4d84a443e3d51b75f8eb64c1512

SHA1
b50c2d7b56347eff07caaa9cb5a4e03e21efd17f

SHA256
5fb2f55f742ac03bd5a3abe456d0d20759d7edfe28019d7c1e537207371b51e1

SHA512
eb31a83149d55af2693e4658217dbbc510b0972be26ade4d9141f9a7693fff41d0cac68c94f5a7c4025acf77f0bce9ecf184345f6a125c1f8144b5922e9469be

Download Submit
C:\Users\Admin\hfOIwMh.IYB

Filesize
260KB

MD5
ed3eca3289c83b6d3c968b39c7c5b62a

SHA1
2c61640cc67926638e7584a4045e7d29cb95b0ba

SHA256
2242aee6f8ecb743d05f06dddd20545d833bf1b11362b9f8cead0b2791eb8ecc

SHA512
ebb5ad68773bf5566ae7c2f93a667224a3060b18bbbf1638eb59c0a49475c3fc9d797ed77ed0895dcf5fdf1e6d37706dc0965db54828f496c6b92868206fdb36

Download Submit
C:\Users\Admin\qVyh.BVI

Filesize
32.7MB

MD5
9e013adda1d29031a077de6f7d5f4611

SHA1
30af3e0fd8de2a3a80ca8e00784724bb50ca572e

SHA256
653506def41220c523a49df251f861a84507174ff1e7bf0e5a2c4e662d30f8f0

SHA512
0e33d6670e88047509bf28c0e3c64327bf35d397908367b15404ac858e8f0506f38e2705f19aec32c74f49f7ba1dfc6fafa92ea0c8b285102990fbdd1f43c76d

Download Submit
C:\Users\Admin\run.vbs

Filesize
89B

MD5
a12b2136ef3b5697cff8528aafc904fe

SHA1
d911834b5f8b0c7b71f4f8e2258d510c1e42e9e9

SHA256
0738ae023c1220e39d62a54db1f19f8eab832c1e8787b0858574056bf2cfc43c

SHA512
99d58123ce2dbcc8a702da42c6bf8a2d2f1ee0bd5e4eba8f43da0ee757ca074fb3c57546ee103b4976109fdb7d7a0ad59cf2da75f4becde22055db315d8bdb47

Download Submit
\Users\Admin\AcrbRd32.exe

Filesize
915KB

MD5
e01ced5c12390ff5256694eda890b33a

SHA1
0bb74a9d3154d1269e5e456aa41e94b60f753f78

SHA256
66c1f3e71685f81f836e29e77844c737ceaa47ff787d6b233b05166973fa73ba

SHA512
93a35ef3749826c1256c4de0fffe099374dbc5cd3d8eccf22690cf2a4c7e63b508ddbe4e412758a84f9c6e9478b5173a6cf93606779af18542d5a2937183219d

Download Submit
memory/1428-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1428-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1428-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1428-40-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1684-68-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1684-67-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1684-69-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1924-59-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1924-60-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1924-61-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2020-53-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-34-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2552-33-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2552-32-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2552-35-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2716-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2716-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2716-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2848-90-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2848-89-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2848-91-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2944-75-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2956-81-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2956-82-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2956-83-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download