isrstealer | 201d2ae7d7de9c5df15b1690808e85d6eb87dc695bfbbd4140b5e6186b8fb81e

Analysis

max time kernel
53s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
201d2ae7d7de9c5df15b1690808e85d6eb87dc695bfbbd4140b5e6186b8fb81e.exe
Size 929KB
Sample221011-khj5kaeefj
SHA256 201d2ae7d7de9c5df15b1690808e85d6eb87dc695bfbbd4140b5e6186b8fb81e
MD5 577da7e578bc7f6457c7d3b5addcd380
SHA1 5aae15674a8f3bf5c26e66e5ed974a96a946c723
SHA512 aecbab2bd16b9c78a9de3f5527a2be71a008db3cd8679b5d80f6a69e90b2c61c1d76817117c997909d4123ee6a2a579a8c52df20a8e4c6675649cb34208eece6
SSDEEP 24576:LNBI5aehOqLefJYBnOuu68GGUEtsh7N1Qq2j:U7hDLefJaOV68OX4j
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

isrstealer collection evasion persistence stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4388-139-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4388-141-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4388-150-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4388-158-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4388-159-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4192-156-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral2/memory/4192-157-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Nirsoft 2 IoCs

resource	yara_rule
behavioral2/memory/4192-156-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/4192-157-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

Executes dropped EXE 1 IoCs

pid	Process
4464	JMpbiEfXrrXD.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1888-145-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1888-147-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1888-148-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1888-149-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4192-153-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4192-155-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4192-156-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4192-157-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	201d2ae7d7de9c5df15b1690808e85d6eb87dc695bfbbd4140b5e6186b8fb81e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	JMpbiEfXrrXD.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	JMpbiEfXrrXD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\c794iancyy78 = "C:\\Users\\Admin\\c794iancyy78\\57076.vbs"	JMpbiEfXrrXD.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	JMpbiEfXrrXD.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4464 set thread context of 4388	4464	JMpbiEfXrrXD.exe	89
PID 4388 set thread context of 1888	4388	RegSvcs.exe	90
PID 4388 set thread context of 4192	4388	RegSvcs.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	JMpbiEfXrrXD.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe
4464	JMpbiEfXrrXD.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe
Token: SeDebugPrivilege	4464	JMpbiEfXrrXD.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4388	RegSvcs.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4464	5048	201d2ae7d7de9c5df15b1690808e85d6eb87dc695bfbbd4140b5e6186b8fb81e.exe	79
PID 5048 wrote to memory of 4464	5048	201d2ae7d7de9c5df15b1690808e85d6eb87dc695bfbbd4140b5e6186b8fb81e.exe	79
PID 5048 wrote to memory of 4464	5048	201d2ae7d7de9c5df15b1690808e85d6eb87dc695bfbbd4140b5e6186b8fb81e.exe	79
PID 4464 wrote to memory of 4388	4464	JMpbiEfXrrXD.exe	89
PID 4464 wrote to memory of 4388	4464	JMpbiEfXrrXD.exe	89
PID 4464 wrote to memory of 4388	4464	JMpbiEfXrrXD.exe	89
PID 4464 wrote to memory of 4388	4464	JMpbiEfXrrXD.exe	89
PID 4464 wrote to memory of 4388	4464	JMpbiEfXrrXD.exe	89
PID 4388 wrote to memory of 1888	4388	RegSvcs.exe	90
PID 4388 wrote to memory of 1888	4388	RegSvcs.exe	90
PID 4388 wrote to memory of 1888	4388	RegSvcs.exe	90
PID 4388 wrote to memory of 1888	4388	RegSvcs.exe	90
PID 4388 wrote to memory of 1888	4388	RegSvcs.exe	90
PID 4388 wrote to memory of 1888	4388	RegSvcs.exe	90
PID 4388 wrote to memory of 1888	4388	RegSvcs.exe	90
PID 4388 wrote to memory of 1888	4388	RegSvcs.exe	90
PID 4388 wrote to memory of 4192	4388	RegSvcs.exe	91
PID 4388 wrote to memory of 4192	4388	RegSvcs.exe	91
PID 4388 wrote to memory of 4192	4388	RegSvcs.exe	91
PID 4388 wrote to memory of 4192	4388	RegSvcs.exe	91
PID 4388 wrote to memory of 4192	4388	RegSvcs.exe	91
PID 4388 wrote to memory of 4192	4388	RegSvcs.exe	91
PID 4388 wrote to memory of 4192	4388	RegSvcs.exe	91
PID 4388 wrote to memory of 4192	4388	RegSvcs.exe	91
PID 4464 wrote to memory of 3316	4464	JMpbiEfXrrXD.exe	92
PID 4464 wrote to memory of 3316	4464	JMpbiEfXrrXD.exe	92
PID 4464 wrote to memory of 3316	4464	JMpbiEfXrrXD.exe	92

C:\Users\Admin\AppData\Local\Temp\201d2ae7d7de9c5df15b1690808e85d6eb87dc695bfbbd4140b5e6186b8fb81e.exe
"C:\Users\Admin\AppData\Local\Temp\201d2ae7d7de9c5df15b1690808e85d6eb87dc695bfbbd4140b5e6186b8fb81e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\c794iancyy78\JMpbiEfXrrXD.exe
  "C:\Users\Admin\c794iancyy78\JMpbiEfXrrXD.exe" mtxFlv.DIN
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      /scomma "C:\Users\Admin\AppData\Local\Temp\lewalvXr7Z.ini"
      4⤵
      PID:1888
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      /scomma "C:\Users\Admin\AppData\Local\Temp\DlmeWsa0J7.ini"
      4⤵
      Accesses Microsoft Outlook accounts
      PID:4192
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\C794IA~1\run.vbs"
    3⤵
    PID:3316
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\C794IA~1\run.vbs"
    3⤵
    PID:5100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lewalvXr7Z.ini

Path C:\Users\Admin\AppData\Local\Temp\lewalvXr7Z.ini
Size 5B
SHA256 fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
MD5 d1ea279fb5559c020a1b4137dc4de237
SHA1 db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA512 720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3
MD5 SHA1 SHA512

Submit Download

NCEyjI.FUL

Path C:\Users\Admin\C794IA~1\NCEyjI.FUL
Size 260KB
SHA256 51fde7624aacae5d06a01127c17a83095b82c514d80ef332c1b7ac0ed282536f
MD5 38da5a8f4795f1773e399a47d2a4f5f0
SHA1 db243b8afeeb1a8e917e882179bbbb8fd38c2cd1
SHA512 58b0cbaa4047d4a9ae91c8fb3d1a9b9c48192e75c95248a9f0320fdab69896548a03349c238d6191bd19d6a176778c13c542db2ee1bf66d6320e93eb452c8219
SSDEEP 6144:g7Auvgt+h2vh/mlZqLeNpNzFG18kgYBCuMwmMiTwu1E:ChIhOqLeG18JYBnmTMu1E
MD5 SHA1 SHA512 SSDEEP

Submit Download

hztwzQgTDNh.BNB

Path C:\Users\Admin\C794IA~1\hztwzQgTDNh.BNB
Size 145B
SHA256 7abeaf9caa0d821556de8a7eccedf0779cbe84fb6c4f9b2042abde42ee152ab2
MD5 8073adab69cdd3df4c6507b7abc36da0
SHA1 daf374b7ef1fd2099f1cd3bd34b445947be36bd2
SHA512 457dd38ecd277e717423bcce11129b0fbcacd2d5baa4e0d0cf7b7a090b6360027c90657b120f790680d10de931efce9c61f63573984bc854b41fe9c9dd46ad37
MD5 SHA1 SHA512

Submit Download

run.vbs

Path C:\Users\Admin\C794IA~1\run.vbs
Size 95B
SHA256 1848f5da2d881bba471623052e7e1f1aeac1b4f0d29d8e8124440def4d97231d
MD5 82ba923c8e5bc5c33edbdfde4d0906ff
SHA1 5cf7b2e9f48d5d6a6b927c1972037cce7f20f1c1
SHA512 15ac03b84f06a2f0c35e2d75ea027a11371ae1c2bbef761998f9381080b7b0858c500db8d32239a691f6490745206cf6a2dd3cb345030684e3152145ac425f96
MD5 SHA1 SHA512

Submit Download

JMpbiEfXrrXD.exe

Path C:\Users\Admin\c794iancyy78\JMpbiEfXrrXD.exe
Size 915KB
SHA256 66c1f3e71685f81f836e29e77844c737ceaa47ff787d6b233b05166973fa73ba
MD5 e01ced5c12390ff5256694eda890b33a
SHA1 0bb74a9d3154d1269e5e456aa41e94b60f753f78
SHA512 93a35ef3749826c1256c4de0fffe099374dbc5cd3d8eccf22690cf2a4c7e63b508ddbe4e412758a84f9c6e9478b5173a6cf93606779af18542d5a2937183219d
SSDEEP 12288:ixFfCqcxzlbhThdxTH8paM8u9ckRxACByAgWngabUmff2l+C63lB:ixFfEV/8phmkbA5AeabP6+C63lB
MD5 SHA1 SHA512 SSDEEP

Submit Download

JMpbiEfXrrXD.exe

Path C:\Users\Admin\c794iancyy78\JMpbiEfXrrXD.exe
Size 915KB
SHA256 66c1f3e71685f81f836e29e77844c737ceaa47ff787d6b233b05166973fa73ba
MD5 e01ced5c12390ff5256694eda890b33a
SHA1 0bb74a9d3154d1269e5e456aa41e94b60f753f78
SHA512 93a35ef3749826c1256c4de0fffe099374dbc5cd3d8eccf22690cf2a4c7e63b508ddbe4e412758a84f9c6e9478b5173a6cf93606779af18542d5a2937183219d
SSDEEP 12288:ixFfCqcxzlbhThdxTH8paM8u9ckRxACByAgWngabUmff2l+C63lB:ixFfEV/8phmkbA5AeabP6+C63lB
MD5 SHA1 SHA512 SSDEEP

Submit Download

mtxFlv.DIN

Path C:\Users\Admin\c794iancyy78\mtxFlv.DIN
Size 34.3MB
SHA256 475a6827e54a04b4e38f929e4fd01ca95015949a3ca64ab12db2e5fe471c5d10
MD5 509beeb65de89099db6d1e8c01da920a
SHA1 b8cb9b4afe15abf52221f4024e6aef925d7752f1
SHA512 c47efc14e990ec15d13ef3ab2c10fc89fc24e5051abd802b517d623fee5604b8c76e223d30d7b84ff647ce5ceb50921b5b3f1fb9ab52a32220ab7117356c55a5
SSDEEP 6144:rUkC+wUkC+wUkC+wUkC+wUkC+wUkC+wUkC+wUkC+wUkC+wUkC+wUkC+wUkC+wUkm:O
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1888-149-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1888-145-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1888-147-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1888-148-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4192-155-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4192-153-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4192-156-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4192-157-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4388-150-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4388-141-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4388-158-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4388-159-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4388-139-0x0000000000400000-0x0000000000442000-memory.dmp

Download