isrstealer | 4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66

General

Target
4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe
Size 349KB
Sample221012-z78lsadadp
SHA256 4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66
MD5 7a50c281feea0a42e92925197fd9bd81
SHA1 130254f2739501ad83e04c02899c7ea9b2eca81f
SHA512 1e8d6cb485aa169e7405ffb88dcef35b6443b0f1f43f4927fbb7f2719af1bfd04213f7e90ad48405f2dd2675cc19b7880101ef3b28e3aacbd6c71efb78822456
SSDEEP 6144:ybkHQbHl7cxAOheBuI17jCmnrXculxMgtg9A8zv9i1Qo96l6OB+knYru89x275yh:ybk+7uAOgQI5G4xxHm9AOv9iSo99S+Mw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

isrstealer persistence spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/1140-135-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/1140-137-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/220-141-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/220-143-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/220-145-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/220-146-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Java.exe"	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2368 set thread context of 1140	2368	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	83
PID 1140 set thread context of 220	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	86
PID 1140 set thread context of 808	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	92

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4548	808	WerFault.exe	92

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1140	2368	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	83
PID 2368 wrote to memory of 1140	2368	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	83
PID 2368 wrote to memory of 1140	2368	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	83
PID 2368 wrote to memory of 1140	2368	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	83
PID 2368 wrote to memory of 1140	2368	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	83
PID 2368 wrote to memory of 1140	2368	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	83
PID 2368 wrote to memory of 1140	2368	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	83
PID 2368 wrote to memory of 1140	2368	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	83
PID 1140 wrote to memory of 220	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	86
PID 1140 wrote to memory of 220	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	86
PID 1140 wrote to memory of 220	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	86
PID 1140 wrote to memory of 220	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	86
PID 1140 wrote to memory of 220	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	86
PID 1140 wrote to memory of 220	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	86
PID 1140 wrote to memory of 220	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	86
PID 1140 wrote to memory of 220	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	86
PID 1140 wrote to memory of 808	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	92
PID 1140 wrote to memory of 808	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	92
PID 1140 wrote to memory of 808	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	92
PID 1140 wrote to memory of 808	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	92
PID 1140 wrote to memory of 808	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	92
PID 1140 wrote to memory of 808	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	92
PID 1140 wrote to memory of 808	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	92
PID 1140 wrote to memory of 808	1140	4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe	92

C:\Users\Admin\AppData\Local\Temp\4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe
"C:\Users\Admin\AppData\Local\Temp\4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe
  C:\Users\Admin\AppData\Local\Temp\4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Users\Admin\AppData\Local\Temp\4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\6CVHeMvVdd.ini"
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\4138dc4d3e022c8b07238a11b602a0ff69caf99af236cf24a20295d753ec8b66.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\es4pkuQqqU.ini"
    3⤵
    PID:808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 80
      4⤵
      Program crash
      PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 808 -ip 808
1⤵
PID:4640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6CVHeMvVdd.ini

Path C:\Users\Admin\AppData\Local\Temp\6CVHeMvVdd.ini
Size 5B
SHA256 fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
MD5 d1ea279fb5559c020a1b4137dc4de237
SHA1 db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA512 720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3
MD5 SHA1 SHA512

Submit Download

memory/220-145-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/220-141-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/220-143-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/220-146-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1140-135-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1140-137-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2368-144-0x00000000752D0000-0x0000000075881000-memory.dmp

Download

memory/2368-132-0x00000000752D0000-0x0000000075881000-memory.dmp

Download

memory/2368-133-0x00000000752D0000-0x0000000075881000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads