isrstealer | c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087

Analysis

max time kernel
4294181s
max time network
123s
platform
windows7_x64
resource
win7-20220223-en
submitted
08/03/2022, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe
Size 386KB
Sample220308-g4c2laegen
SHA256 c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087
MD5 c797d7a9adbc5012b79487311efcfd1d
SHA1 b36e3f2f4baa0ff0409351b8e285787cbe19d1c1
SHA512 030c1e3b1fc676b03841dc758de7b76d1ad54c31883248cc3aea4db23b64507958c64bf771d3247149626eb5d7b7fdb3a0bbf2b5115cb31fc5088eff35866b02
MD5 SHA1 SHA512

Score

10^/10

isrstealer collection spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer Payload 1 IoCs

resource	yara_rule
behavioral1/memory/268-55-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1868-77-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral1/memory/1868-78-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Nirsoft 2 IoCs

resource	yara_rule
behavioral1/memory/1868-77-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/1868-78-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/760-62-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/760-65-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/760-67-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/760-69-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/760-68-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1868-71-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1868-74-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1868-76-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1868-77-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1868-78-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	regasm.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1112 set thread context of 268	1112	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	27
PID 268 set thread context of 760	268	regasm.exe	28
PID 268 set thread context of 1868	268	regasm.exe	31

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1112	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
268	regasm.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 268	1112	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	27
PID 1112 wrote to memory of 268	1112	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	27
PID 1112 wrote to memory of 268	1112	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	27
PID 1112 wrote to memory of 268	1112	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	27
PID 1112 wrote to memory of 268	1112	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	27
PID 1112 wrote to memory of 268	1112	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	27
PID 1112 wrote to memory of 268	1112	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	27
PID 1112 wrote to memory of 268	1112	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	27
PID 1112 wrote to memory of 268	1112	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	27
PID 1112 wrote to memory of 268	1112	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	27
PID 1112 wrote to memory of 268	1112	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	27
PID 1112 wrote to memory of 268	1112	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	27
PID 268 wrote to memory of 760	268	regasm.exe	28
PID 268 wrote to memory of 760	268	regasm.exe	28
PID 268 wrote to memory of 760	268	regasm.exe	28
PID 268 wrote to memory of 760	268	regasm.exe	28
PID 268 wrote to memory of 760	268	regasm.exe	28
PID 268 wrote to memory of 760	268	regasm.exe	28
PID 268 wrote to memory of 760	268	regasm.exe	28
PID 268 wrote to memory of 760	268	regasm.exe	28
PID 268 wrote to memory of 760	268	regasm.exe	28
PID 268 wrote to memory of 760	268	regasm.exe	28
PID 268 wrote to memory of 760	268	regasm.exe	28
PID 268 wrote to memory of 760	268	regasm.exe	28
PID 268 wrote to memory of 1868	268	regasm.exe	31
PID 268 wrote to memory of 1868	268	regasm.exe	31
PID 268 wrote to memory of 1868	268	regasm.exe	31
PID 268 wrote to memory of 1868	268	regasm.exe	31
PID 268 wrote to memory of 1868	268	regasm.exe	31
PID 268 wrote to memory of 1868	268	regasm.exe	31
PID 268 wrote to memory of 1868	268	regasm.exe	31
PID 268 wrote to memory of 1868	268	regasm.exe	31
PID 268 wrote to memory of 1868	268	regasm.exe	31
PID 268 wrote to memory of 1868	268	regasm.exe	31
PID 268 wrote to memory of 1868	268	regasm.exe	31
PID 268 wrote to memory of 1868	268	regasm.exe	31

C:\Users\Admin\AppData\Local\Temp\c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe
"C:\Users\Admin\AppData\Local\Temp\c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
  "C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\MHmtQ6TaIw.ini"
    3⤵
    PID:760
- - C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\66pKtVXn88.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:1868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-55-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/760-69-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/760-62-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/760-65-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/760-67-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/760-68-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1112-54-0x0000000076761000-0x0000000076763000-memory.dmp

Download

memory/1112-60-0x0000000074A90000-0x000000007503B000-memory.dmp

Download

memory/1868-71-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1868-74-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1868-76-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1868-77-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1868-78-0x0000000000400000-0x000000000041F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads