isrstealer | 8371ad57c9f598e7bad4e96b4c4e0749971cbe42cfd175b0b8dbedab90eb7bea

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 01:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DOCUMENT.exe
Size

941KB
MD5

752ce2568a7b41a0fcbbc5f417ffccc3
SHA1

864e7e6514a207df0b70066eecd6126becb1ff09
SHA256

7b6570a85ef1600456266810593fd5e2de186f34ed7868ace12148ec14f8812e
SHA512

70e58cde454e360df36784f48b2795a96d4f8fadc797d6667bff73a4b217518584177972398eaa5d12d082301ee8bd37c148d05b0da39ffb51b5da6650f84538
SSDEEP

12288:5at0EAH49n8B7CnN/j2+T0BWLkGLbWgNIwY6Cuw78YOJEn1GUEVQqYHQFOH9LPsN:It24RNj2+TGqkOhNSu68GGUEtsh7N10N

Score

10^/10

isrstealer collection discovery evasion persistence stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 6 IoCs

resource	yara_rule
behavioral2/memory/396-39-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/396-42-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/396-56-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/396-57-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/2476-64-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/988-80-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

Isrstealer family
isrstealer

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	AcrbRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	AcrbRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	AcrbRd32.exe

Detected Nirsoft tools 2 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/1532-76-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/4404-92-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1532-76-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral2/memory/4404-92-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	AcrbRd32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	AcrbRd32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DOCUMENT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	AcrbRd32.exe

Executes dropped EXE 4 IoCs

pid	Process
1576	AcrbRd32.exe
4564	AcrbRd32.exe
3632	AcrbRd32.exe
3500	AcrbRd32.exe

Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\4zo2p4375w9716n = "C:\\Users\\Admin\\4zo2p4375w9716n\\79711.vbs"	AcrbRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\4zo2p4375w9716n = "C:\\Users\\Admin\\4zo2p4375w9716n\\79711.vbs"	AcrbRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\4zo2p4375w9716n = "C:\\Users\\Admin\\4zo2p4375w9716n\\79711.vbs"	AcrbRd32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AcrbRd32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AcrbRd32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AcrbRd32.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 1576 set thread context of 396	1576	AcrbRd32.exe	100
PID 396 set thread context of 4928	396	RegSvcs.exe	101
PID 396 set thread context of 928	396	RegSvcs.exe	103
PID 4564 set thread context of 2476	4564	AcrbRd32.exe	110
PID 2476 set thread context of 1848	2476	RegSvcs.exe	111
PID 2476 set thread context of 1532	2476	RegSvcs.exe	113
PID 3632 set thread context of 988	3632	AcrbRd32.exe	117
PID 988 set thread context of 2656	988	RegSvcs.exe	118
PID 988 set thread context of 4404	988	RegSvcs.exe	120

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4928-45-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4928-47-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4928-48-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4928-49-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4928-51-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1848-68-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1848-69-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1532-74-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1532-75-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1532-76-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2656-84-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/2656-85-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4404-91-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4404-92-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3500	928	WerFault.exe	103

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DOCUMENT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcrbRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcrbRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcrbRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcrbRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	AcrbRd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	AcrbRd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	AcrbRd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
1576	AcrbRd32.exe
4564	AcrbRd32.exe
4564	AcrbRd32.exe
4564	AcrbRd32.exe
4564	AcrbRd32.exe
4564	AcrbRd32.exe
4564	AcrbRd32.exe
4564	AcrbRd32.exe
4564	AcrbRd32.exe
4564	AcrbRd32.exe
4564	AcrbRd32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	AcrbRd32.exe
Token: SeDebugPrivilege	4564	AcrbRd32.exe
Token: SeDebugPrivilege	3632	AcrbRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
396	RegSvcs.exe
2476	RegSvcs.exe
988	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 1576	3092	DOCUMENT.exe	83
PID 3092 wrote to memory of 1576	3092	DOCUMENT.exe	83
PID 3092 wrote to memory of 1576	3092	DOCUMENT.exe	83
PID 1576 wrote to memory of 396	1576	AcrbRd32.exe	100
PID 1576 wrote to memory of 396	1576	AcrbRd32.exe	100
PID 1576 wrote to memory of 396	1576	AcrbRd32.exe	100
PID 1576 wrote to memory of 396	1576	AcrbRd32.exe	100
PID 1576 wrote to memory of 396	1576	AcrbRd32.exe	100
PID 396 wrote to memory of 4928	396	RegSvcs.exe	101
PID 396 wrote to memory of 4928	396	RegSvcs.exe	101
PID 396 wrote to memory of 4928	396	RegSvcs.exe	101
PID 396 wrote to memory of 4928	396	RegSvcs.exe	101
PID 396 wrote to memory of 4928	396	RegSvcs.exe	101
PID 396 wrote to memory of 4928	396	RegSvcs.exe	101
PID 396 wrote to memory of 4928	396	RegSvcs.exe	101
PID 396 wrote to memory of 4928	396	RegSvcs.exe	101
PID 396 wrote to memory of 928	396	RegSvcs.exe	103
PID 396 wrote to memory of 928	396	RegSvcs.exe	103
PID 396 wrote to memory of 928	396	RegSvcs.exe	103
PID 396 wrote to memory of 928	396	RegSvcs.exe	103
PID 396 wrote to memory of 928	396	RegSvcs.exe	103
PID 396 wrote to memory of 928	396	RegSvcs.exe	103
PID 396 wrote to memory of 928	396	RegSvcs.exe	103
PID 396 wrote to memory of 928	396	RegSvcs.exe	103
PID 1576 wrote to memory of 4584	1576	AcrbRd32.exe	108
PID 1576 wrote to memory of 4584	1576	AcrbRd32.exe	108
PID 1576 wrote to memory of 4584	1576	AcrbRd32.exe	108
PID 4584 wrote to memory of 4564	4584	WScript.exe	109
PID 4584 wrote to memory of 4564	4584	WScript.exe	109
PID 4584 wrote to memory of 4564	4584	WScript.exe	109
PID 4564 wrote to memory of 2476	4564	AcrbRd32.exe	110
PID 4564 wrote to memory of 2476	4564	AcrbRd32.exe	110
PID 4564 wrote to memory of 2476	4564	AcrbRd32.exe	110
PID 4564 wrote to memory of 2476	4564	AcrbRd32.exe	110
PID 4564 wrote to memory of 2476	4564	AcrbRd32.exe	110
PID 2476 wrote to memory of 1848	2476	RegSvcs.exe	111
PID 2476 wrote to memory of 1848	2476	RegSvcs.exe	111
PID 2476 wrote to memory of 1848	2476	RegSvcs.exe	111
PID 2476 wrote to memory of 1848	2476	RegSvcs.exe	111
PID 2476 wrote to memory of 1848	2476	RegSvcs.exe	111
PID 2476 wrote to memory of 1848	2476	RegSvcs.exe	111
PID 2476 wrote to memory of 1848	2476	RegSvcs.exe	111
PID 2476 wrote to memory of 1848	2476	RegSvcs.exe	111
PID 2476 wrote to memory of 1532	2476	RegSvcs.exe	113
PID 2476 wrote to memory of 1532	2476	RegSvcs.exe	113
PID 2476 wrote to memory of 1532	2476	RegSvcs.exe	113
PID 2476 wrote to memory of 1532	2476	RegSvcs.exe	113
PID 2476 wrote to memory of 1532	2476	RegSvcs.exe	113
PID 2476 wrote to memory of 1532	2476	RegSvcs.exe	113
PID 2476 wrote to memory of 1532	2476	RegSvcs.exe	113
PID 2476 wrote to memory of 1532	2476	RegSvcs.exe	113
PID 4564 wrote to memory of 856	4564	AcrbRd32.exe	115
PID 4564 wrote to memory of 856	4564	AcrbRd32.exe	115
PID 4564 wrote to memory of 856	4564	AcrbRd32.exe	115
PID 856 wrote to memory of 3632	856	WScript.exe	116
PID 856 wrote to memory of 3632	856	WScript.exe	116
PID 856 wrote to memory of 3632	856	WScript.exe	116
PID 3632 wrote to memory of 988	3632	AcrbRd32.exe	117
PID 3632 wrote to memory of 988	3632	AcrbRd32.exe	117
PID 3632 wrote to memory of 988	3632	AcrbRd32.exe	117
PID 3632 wrote to memory of 988	3632	AcrbRd32.exe	117
PID 3632 wrote to memory of 988	3632	AcrbRd32.exe	117
PID 988 wrote to memory of 2656	988	RegSvcs.exe	118
PID 988 wrote to memory of 2656	988	RegSvcs.exe	118

C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe
"C:\Users\Admin\AppData\Local\Temp\DOCUMENT.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Users\Admin\AcrbRd32.exe
  "C:\Users\Admin\AcrbRd32.exe" qVyh.BVI
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      /scomma "C:\Users\Admin\AppData\Local\Temp\GfIJCcLihM.ini"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4928
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      /scomma "C:\Users\Admin\AppData\Local\Temp\bjVbHkd0yH.ini"
      4⤵
      PID:928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 80
        5⤵
        Program crash
        
        PID:3500
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\run.vbs"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Users\Admin\AcrbRd32.exe
      "C:\Users\Admin\AcrbRd32.exe" qVyh.BVI
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4564
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2476
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\wPfPRT9BWB.ini"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\BzgD1kpnQQ.ini"
        6⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1532
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\run.vbs"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:856
      - C:\Users\Admin\AcrbRd32.exe
        
        "C:\Users\Admin\AcrbRd32.exe" qVyh.BVI
        6⤵
        Modifies visiblity of hidden/system files in Explorer
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:988
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\6MZSuFIJUC.ini"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\JF3hhL9SYe.ini"
        8⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:4404
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\run.vbs"
        7⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:780
        
        C:\Users\Admin\AcrbRd32.exe
        
        "C:\Users\Admin\AcrbRd32.exe" qVyh.BVI
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 928 -ip 928
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AcrbRd32.exe

Filesize
915KB

MD5
e01ced5c12390ff5256694eda890b33a

SHA1
0bb74a9d3154d1269e5e456aa41e94b60f753f78

SHA256
66c1f3e71685f81f836e29e77844c737ceaa47ff787d6b233b05166973fa73ba

SHA512
93a35ef3749826c1256c4de0fffe099374dbc5cd3d8eccf22690cf2a4c7e63b508ddbe4e412758a84f9c6e9478b5173a6cf93606779af18542d5a2937183219d

Download Submit
C:\Users\Admin\AppData\Local\Temp\GfIJCcLihM.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\start.lnk

Filesize
778B

MD5
1424229d31e7d66f07c59008e25a141d

SHA1
300390e5819cf9bf5841e2abee761a73bac7a217

SHA256
26b2246f12f17391a1462741fe8cc10db5d601f28dbdb2a93b9065864ee62b59

SHA512
741d3ea5bd61966c900e3dcf50e01425b7ed58454af3a4610e936e367af25e096d409a5667ea6c7497281108a19e67beeddb2e43920710047870356c61fda866

Download Submit
C:\Users\Admin\fqNvzVucd.WFW

Filesize
176B

MD5
1228f4d84a443e3d51b75f8eb64c1512

SHA1
b50c2d7b56347eff07caaa9cb5a4e03e21efd17f

SHA256
5fb2f55f742ac03bd5a3abe456d0d20759d7edfe28019d7c1e537207371b51e1

SHA512
eb31a83149d55af2693e4658217dbbc510b0972be26ade4d9141f9a7693fff41d0cac68c94f5a7c4025acf77f0bce9ecf184345f6a125c1f8144b5922e9469be

Download Submit
C:\Users\Admin\hfOIwMh.IYB

Filesize
260KB

MD5
ed3eca3289c83b6d3c968b39c7c5b62a

SHA1
2c61640cc67926638e7584a4045e7d29cb95b0ba

SHA256
2242aee6f8ecb743d05f06dddd20545d833bf1b11362b9f8cead0b2791eb8ecc

SHA512
ebb5ad68773bf5566ae7c2f93a667224a3060b18bbbf1638eb59c0a49475c3fc9d797ed77ed0895dcf5fdf1e6d37706dc0965db54828f496c6b92868206fdb36

Download Submit
C:\Users\Admin\qVyh.BVI

Filesize
32.7MB

MD5
9e013adda1d29031a077de6f7d5f4611

SHA1
30af3e0fd8de2a3a80ca8e00784724bb50ca572e

SHA256
653506def41220c523a49df251f861a84507174ff1e7bf0e5a2c4e662d30f8f0

SHA512
0e33d6670e88047509bf28c0e3c64327bf35d397908367b15404ac858e8f0506f38e2705f19aec32c74f49f7ba1dfc6fafa92ea0c8b285102990fbdd1f43c76d

Download Submit
C:\Users\Admin\run.vbs

Filesize
89B

MD5
a12b2136ef3b5697cff8528aafc904fe

SHA1
d911834b5f8b0c7b71f4f8e2258d510c1e42e9e9

SHA256
0738ae023c1220e39d62a54db1f19f8eab832c1e8787b0858574056bf2cfc43c

SHA512
99d58123ce2dbcc8a702da42c6bf8a2d2f1ee0bd5e4eba8f43da0ee757ca074fb3c57546ee103b4976109fdb7d7a0ad59cf2da75f4becde22055db315d8bdb47

Download Submit
memory/396-42-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/396-39-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/396-57-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/396-56-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/988-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1532-76-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1532-74-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1532-75-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1848-68-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1848-69-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2476-64-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2656-84-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2656-85-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4404-91-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4404-92-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4928-51-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4928-49-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4928-48-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4928-47-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4928-45-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download