Analysis
- max time kernel
100s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
01/10/2022, 23:31
General
- Target c36bc0ca3a90e6cd29de463ff9b54525c18930d1e5a38cfd0f3e366e574eb401.exe
- Size 2.2MB
- Sample221001-3h8f9sdccm
- SHA256 c36bc0ca3a90e6cd29de463ff9b54525c18930d1e5a38cfd0f3e366e574eb401
Malware Config
Signatures
- ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
- ISR Stealer payload 4 IoCs
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- Nirsoft 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c36bc0ca3a90e6cd29de463ff9b54525c18930d1e5a38cfd0f3e366e574eb401.exe"C:\Users\Admin\AppData\Local\Temp\c36bc0ca3a90e6cd29de463ff9b54525c18930d1e5a38cfd0f3e366e574eb401.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c36bc0ca3a90e6cd29de463ff9b54525c18930d1e5a38cfd0f3e366e574eb401.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c36bc0ca3a90e6cd29de463ff9b54525c18930d1e5a38cfd0f3e366e574eb401.exe/scomma "C:\Users\Admin\AppData\Local\Temp\ZjDI8IvAhL.ini"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\c36bc0ca3a90e6cd29de463ff9b54525c18930d1e5a38cfd0f3e366e574eb401.exe/scomma "C:\Users\Admin\AppData\Local\Temp\dnjaHuaqMH.ini"3⤵
- Accesses Microsoft Outlook accounts
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
ZjDI8IvAhL.ini
memory/2124-414-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2672-401-0x0000000000400000-0x0000000000453000-memory.dmp
memory/2672-406-0x0000000000400000-0x0000000000453000-memory.dmp
memory/3652-400-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3652-415-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3652-408-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4344-168-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-175-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-143-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-144-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-145-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-146-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-148-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-147-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-149-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-150-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-151-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-152-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-154-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-155-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-156-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-158-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-159-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-160-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-157-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-153-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-161-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-163-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-162-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-164-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-165-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-166-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-167-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-170-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-141-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-169-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-171-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-172-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-174-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-142-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-173-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-176-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-178-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-177-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-179-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-180-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-181-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-182-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-184-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-183-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-185-0x0000000002420000-0x00000000024CE000-memory.dmp
memory/4344-186-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-187-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-188-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-189-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-190-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-191-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-192-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-193-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-194-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-195-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-196-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-197-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-390-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/4344-391-0x0000000002420000-0x00000000024CE000-memory.dmp
memory/4344-403-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/4344-140-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-139-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-138-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-137-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/4344-132-0x0000000000750000-0x000000000080D000-memory.dmp
memory/4344-404-0x0000000002420000-0x00000000024CE000-memory.dmp