isrstealer | 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a

Analysis

max time kernel
58s
max time network
143s
platform
windows10_x64
resource
win10v20201028
submitted
10/11/2020, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe
Size 783KB
Sample201110-kepef222mj
SHA256 1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a
MD5 fae8750fc4fbb827a87258ce330251a8
SHA1 1141f067de255d7442cfde1fc6991e20db57e4ba
SHA512 251ecd8fda7a8cd4f5ca9c7714cbe4c5d9a12d329ae21e05757a8682b73abcc79b59d8f20105f3837eedd932c1b3473f6f58ef8fd1ae6ff3cb184692907192dc
MD5 SHA1 SHA512

Score

10^/10

isrstealer spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer Payload 3 IoCs

resource	yara_rule
behavioral2/memory/2108-10-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/2108-11-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral2/memory/2108-12-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/904-23-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Nirsoft 1 IoCs

resource	yara_rule
behavioral2/memory/904-23-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/536-15-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/536-17-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/536-18-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/904-20-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/904-22-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/904-23-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4704 set thread context of 2108	4704	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	78
PID 2108 set thread context of 536	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	79
PID 2108 set thread context of 904	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 2108	4704	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	78
PID 4704 wrote to memory of 2108	4704	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	78
PID 4704 wrote to memory of 2108	4704	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	78
PID 4704 wrote to memory of 2108	4704	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	78
PID 4704 wrote to memory of 2108	4704	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	78
PID 4704 wrote to memory of 2108	4704	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	78
PID 4704 wrote to memory of 2108	4704	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	78
PID 2108 wrote to memory of 536	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	79
PID 2108 wrote to memory of 536	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	79
PID 2108 wrote to memory of 536	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	79
PID 2108 wrote to memory of 536	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	79
PID 2108 wrote to memory of 536	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	79
PID 2108 wrote to memory of 536	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	79
PID 2108 wrote to memory of 536	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	79
PID 2108 wrote to memory of 536	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	79
PID 2108 wrote to memory of 904	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	80
PID 2108 wrote to memory of 904	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	80
PID 2108 wrote to memory of 904	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	80
PID 2108 wrote to memory of 904	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	80
PID 2108 wrote to memory of 904	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	80
PID 2108 wrote to memory of 904	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	80
PID 2108 wrote to memory of 904	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	80
PID 2108 wrote to memory of 904	2108	1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe	80

C:\Users\Admin\AppData\Local\Temp\1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe
"C:\Users\Admin\AppData\Local\Temp\1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Users\Admin\AppData\Local\Temp\1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe
  "{path}"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Users\Admin\AppData\Local\Temp\1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\J6CxHUSEd9.ini"
    3⤵
    PID:536
- - C:\Users\Admin\AppData\Local\Temp\1cd12640cd035338923aac16f8cbbc1625c3cd58b9dbb38e524948554ecea48a.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\AvI4Fh9LK6.ini"
    3⤵
    PID:904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-15-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/536-18-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/536-17-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/904-23-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/904-22-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/904-20-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2108-12-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2108-10-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4704-0-0x0000000073FA0000-0x000000007468E000-memory.dmp

Download

memory/4704-9-0x0000000007BC0000-0x0000000007BC1000-memory.dmp

Download

memory/4704-8-0x0000000007510000-0x00000000075B7000-memory.dmp

Download

memory/4704-7-0x0000000007230000-0x0000000007244000-memory.dmp

Download

memory/4704-6-0x00000000075F0000-0x00000000075F1000-memory.dmp

Download

memory/4704-5-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Download

memory/4704-4-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Download

memory/4704-3-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Download

memory/4704-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads