Analysis
-
max time kernel
4294178s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
12-03-2022 07:59
Static task
static1
Behavioral task
behavioral1
Sample
91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe
Resource
win10v2004-20220310-en
General
-
Target
91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe
-
Size
1.8MB
-
MD5
6dde36c30de2cb0df6d3b71e330c09e8
-
SHA1
ef8c7b872da4633c5cd2ead357b2e8279d182ff9
-
SHA256
91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f
-
SHA512
2cea75a5241077aaf1ba809f088a1520c4719e2986bfe5f7abef77b3265332c48690942535c46c78020a2174d72f78d2bec83bce1292491628da335047a16abb
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer Payload 1 IoCs
resource yara_rule behavioral1/memory/1808-58-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer -
resource yara_rule behavioral1/memory/1780-64-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/1780-67-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/1780-69-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/1780-70-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/1780-71-0x0000000000400000-0x0000000000453000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1428 set thread context of 1808 1428 91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe 29 PID 1808 set thread context of 1780 1808 regasm.exe 30 PID 1808 set thread context of 1100 1808 regasm.exe 31 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1428 91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1808 regasm.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1428 wrote to memory of 1808 1428 91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe 29 PID 1428 wrote to memory of 1808 1428 91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe 29 PID 1428 wrote to memory of 1808 1428 91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe 29 PID 1428 wrote to memory of 1808 1428 91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe 29 PID 1428 wrote to memory of 1808 1428 91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe 29 PID 1428 wrote to memory of 1808 1428 91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe 29 PID 1428 wrote to memory of 1808 1428 91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe 29 PID 1428 wrote to memory of 1808 1428 91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe 29 PID 1428 wrote to memory of 1808 1428 91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe 29 PID 1428 wrote to memory of 1808 1428 91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe 29 PID 1428 wrote to memory of 1808 1428 91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe 29 PID 1428 wrote to memory of 1808 1428 91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe 29 PID 1808 wrote to memory of 1780 1808 regasm.exe 30 PID 1808 wrote to memory of 1780 1808 regasm.exe 30 PID 1808 wrote to memory of 1780 1808 regasm.exe 30 PID 1808 wrote to memory of 1780 1808 regasm.exe 30 PID 1808 wrote to memory of 1780 1808 regasm.exe 30 PID 1808 wrote to memory of 1780 1808 regasm.exe 30 PID 1808 wrote to memory of 1780 1808 regasm.exe 30 PID 1808 wrote to memory of 1780 1808 regasm.exe 30 PID 1808 wrote to memory of 1780 1808 regasm.exe 30 PID 1808 wrote to memory of 1780 1808 regasm.exe 30 PID 1808 wrote to memory of 1780 1808 regasm.exe 30 PID 1808 wrote to memory of 1780 1808 regasm.exe 30 PID 1808 wrote to memory of 1100 1808 regasm.exe 31 PID 1808 wrote to memory of 1100 1808 regasm.exe 31 PID 1808 wrote to memory of 1100 1808 regasm.exe 31 PID 1808 wrote to memory of 1100 1808 regasm.exe 31 PID 1808 wrote to memory of 1100 1808 regasm.exe 31 PID 1808 wrote to memory of 1100 1808 regasm.exe 31 PID 1808 wrote to memory of 1100 1808 regasm.exe 31 PID 1808 wrote to memory of 1100 1808 regasm.exe 31 PID 1808 wrote to memory of 1100 1808 regasm.exe 31 PID 1808 wrote to memory of 1100 1808 regasm.exe 31 PID 1808 wrote to memory of 1100 1808 regasm.exe 31 PID 1808 wrote to memory of 1100 1808 regasm.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe"C:\Users\Admin\AppData\Local\Temp\91ed0d89cfea28fa7889128593cb541b3da9088cf5ea5b8b09047f765b275d9f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe/scomma "C:\Users\Admin\AppData\Local\Temp\fwzjTKh8w9.ini"3⤵PID:1780
-
-
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe/scomma "C:\Users\Admin\AppData\Local\Temp\jQCDLrIz9J.ini"3⤵PID:1100
-
-