isrstealer | 2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8

Analysis

max time kernel
108s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 23:22

Target
2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe
Size 300KB
Sample221001-3c3ntsbff6
SHA256 2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8
MD5 6cf643e295d84b5197d51c5a1fd23149
SHA1 023faa8a7269e7d5dd2ca235c907e9f9f5d940da
SHA512 4b41a5a7d66996a7ab3ab622de66257278002a171de1b3904ecfd1d85ba4ff8e9cd98a6fdfb64a56107f87d8e9c356affbfad7cfb099a92937147340ae2ff04a
SSDEEP 6144:FOBTAUpS671v8nHNW4SL6+W6y5L3N/BC5SgbjXBy3:FOBTPlhqtWVL6+CpQ55XBw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/2320-136-0x0000000000D00000-0x0000000000D42000-memory.dmp	family_isrstealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1760 set thread context of 2320	1760	2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1760	2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe
1760	2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2320	1760	2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe	85
PID 1760 wrote to memory of 2320	1760	2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe	85
PID 1760 wrote to memory of 2320	1760	2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe	85
PID 1760 wrote to memory of 2320	1760	2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe	85
PID 1760 wrote to memory of 2320	1760	2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe	85
PID 1760 wrote to memory of 2320	1760	2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe	85
PID 1760 wrote to memory of 2320	1760	2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe	85

C:\Users\Admin\AppData\Local\Temp\2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe
"C:\Users\Admin\AppData\Local\Temp\2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe
  "C:\Users\Admin\AppData\Local\Temp\2725f195a28405f562832d8c180aee96e410c4f715b45fa1de754cb5f80f36a8.exe"
  2⤵
  PID:2320

memory/1760-132-0x0000000074750000-0x0000000074D01000-memory.dmp

Download

memory/1760-133-0x0000000074750000-0x0000000074D01000-memory.dmp

Download

memory/1760-138-0x0000000074750000-0x0000000074D01000-memory.dmp

Download

memory/2320-136-0x0000000000D00000-0x0000000000D42000-memory.dmp

Download