isrstealer | 27d0d28bfd7016b70a64b54b3ac8ae1e3d0823fc9d81d3e2677a07ad39a91311

Analysis

Target

order.scr
Size

665KB
MD5

9f0468e88be1ae4bb8880bcfcb4d5d4a
SHA1

8948672d1a4f1d50f63475e8c6a5cac6593e891c
SHA256

132056e5d63b84a40734ac2365756e9fdea92a8dbbe37dd55b26281056f7b5d0
SHA512

02950743196ad08a2f14f3e013db4c819674d1748b7454bd5f1f69f00fd39d20940a8ecba6e2d985d270f3d3ec8db1bca93a116ad3a6d2384cfb339f97a7f085

Score

10^/10

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1836-58-0x0000000000090000-0x00000000000D2000-memory.dmp	family_isrstealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1172 set thread context of 1836	1172	order.scr	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	order.scr

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1836	1172	order.scr	27
PID 1172 wrote to memory of 1836	1172	order.scr	27
PID 1172 wrote to memory of 1836	1172	order.scr	27
PID 1172 wrote to memory of 1836	1172	order.scr	27
PID 1172 wrote to memory of 1836	1172	order.scr	27
PID 1172 wrote to memory of 1836	1172	order.scr	27
PID 1172 wrote to memory of 1836	1172	order.scr	27
PID 1172 wrote to memory of 1836	1172	order.scr	27
PID 1172 wrote to memory of 1836	1172	order.scr	27
PID 1172 wrote to memory of 1836	1172	order.scr	27
PID 1172 wrote to memory of 1836	1172	order.scr	27

C:\Users\Admin\AppData\Local\Temp\order.scr
"C:\Users\Admin\AppData\Local\Temp\order.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:1836

memory/1172-54-0x00000000755A1000-0x00000000755A3000-memory.dmp

Filesize
8KB

Download
memory/1172-55-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/1172-56-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/1172-60-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/1172-61-0x00000000022F6000-0x0000000002307000-memory.dmp

Filesize
68KB

Download
memory/1836-58-0x0000000000090000-0x00000000000D2000-memory.dmp

Filesize
264KB

Download