isrstealer | 27d0d28bfd7016b70a64b54b3ac8ae1e3d0823fc9d81d3e2677a07ad39a91311 | Triage

Analysis

max time kernel
145s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
16-06-2022 03:13

Sharing

Report Analysis Logs

General

Target

order.scr
Size

665KB
MD5

9f0468e88be1ae4bb8880bcfcb4d5d4a
SHA1

8948672d1a4f1d50f63475e8c6a5cac6593e891c
SHA256

132056e5d63b84a40734ac2365756e9fdea92a8dbbe37dd55b26281056f7b5d0
SHA512

02950743196ad08a2f14f3e013db4c819674d1748b7454bd5f1f69f00fd39d20940a8ecba6e2d985d270f3d3ec8db1bca93a116ad3a6d2384cfb339f97a7f085

Score

10^/10

isrstealer stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3812-134-0x0000000000610000-0x0000000000652000-memory.dmp	family_isrstealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3480 set thread context of 3812	3480	order.scr	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	order.scr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3812	3480	order.scr	82
PID 3480 wrote to memory of 3812	3480	order.scr	82
PID 3480 wrote to memory of 3812	3480	order.scr	82
PID 3480 wrote to memory of 3812	3480	order.scr	82
PID 3480 wrote to memory of 3812	3480	order.scr	82
PID 3480 wrote to memory of 3812	3480	order.scr	82
PID 3480 wrote to memory of 3812	3480	order.scr	82

C:\Users\Admin\AppData\Local\Temp\order.scr
"C:\Users\Admin\AppData\Local\Temp\order.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:3812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3480-130-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/3480-131-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/3480-136-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/3812-134-0x0000000000610000-0x0000000000652000-memory.dmp

Filesize
264KB

Download