isrstealer | efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a

Analysis

max time kernel
151s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2022, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
Size 522KB
Sample221013-t6882adfc8
SHA256 efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a
MD5 6bee3391e37c6e0715fbbae6a71de790
SHA1 f8fc14887d13a9df24558d3cc927d420d3fa36d5
SHA512 cc2e5cb0dfc28c3f75db938535962b67b96c2ffd8d1a1ea14d97f3790c84d844ed17b064722308edefe539f376ba556b3beb5660f4dda5e2551662a948027a2b
SSDEEP 12288:i6kHB9C+9s3WRQukIyYZcEzVzl4b4M05KxdlEGHuXmtbsL:q9sc2Ayq8001E6o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

isrstealer stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/4324-137-0x0000000000170000-0x00000000001B2000-memory.dmp	family_isrstealer

Executes dropped EXE 3 IoCs

pid	Process
2312	wpasv.exe
1032	agpmgr.exe
2940	wpasv.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	wpasv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	agpmgr.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4288 set thread context of 4324	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe	93
PID 1032 set thread context of 1324	1032	agpmgr.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
2312	wpasv.exe
4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
Token: SeDebugPrivilege	2312	wpasv.exe
Token: SeDebugPrivilege	1032	agpmgr.exe
Token: SeDebugPrivilege	2940	wpasv.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 1984	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe	91
PID 4288 wrote to memory of 1984	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe	91
PID 4288 wrote to memory of 1984	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe	91
PID 4288 wrote to memory of 4324	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe	93
PID 4288 wrote to memory of 4324	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe	93
PID 4288 wrote to memory of 4324	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe	93
PID 4288 wrote to memory of 4324	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe	93
PID 4288 wrote to memory of 4324	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe	93
PID 4288 wrote to memory of 4324	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe	93
PID 4288 wrote to memory of 4324	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe	93
PID 4288 wrote to memory of 3816	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe	94
PID 4288 wrote to memory of 3816	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe	94
PID 4288 wrote to memory of 3816	4288	efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe	94
PID 3816 wrote to memory of 2312	3816	cmd.exe	96
PID 3816 wrote to memory of 2312	3816	cmd.exe	96
PID 3816 wrote to memory of 2312	3816	cmd.exe	96
PID 2312 wrote to memory of 1032	2312	wpasv.exe	97
PID 2312 wrote to memory of 1032	2312	wpasv.exe	97
PID 2312 wrote to memory of 1032	2312	wpasv.exe	97
PID 2312 wrote to memory of 5112	2312	wpasv.exe	98
PID 2312 wrote to memory of 5112	2312	wpasv.exe	98
PID 2312 wrote to memory of 5112	2312	wpasv.exe	98
PID 5112 wrote to memory of 840	5112	cmd.exe	100
PID 5112 wrote to memory of 840	5112	cmd.exe	100
PID 5112 wrote to memory of 840	5112	cmd.exe	100
PID 1032 wrote to memory of 1324	1032	agpmgr.exe	101
PID 1032 wrote to memory of 1324	1032	agpmgr.exe	101
PID 1032 wrote to memory of 1324	1032	agpmgr.exe	101
PID 1032 wrote to memory of 1324	1032	agpmgr.exe	101
PID 1032 wrote to memory of 1324	1032	agpmgr.exe	101
PID 1032 wrote to memory of 1324	1032	agpmgr.exe	101
PID 1032 wrote to memory of 1324	1032	agpmgr.exe	101
PID 1032 wrote to memory of 4184	1032	agpmgr.exe	102
PID 1032 wrote to memory of 4184	1032	agpmgr.exe	102
PID 1032 wrote to memory of 4184	1032	agpmgr.exe	102
PID 4184 wrote to memory of 2940	4184	cmd.exe	104
PID 4184 wrote to memory of 2940	4184	cmd.exe	104
PID 4184 wrote to memory of 2940	4184	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe
"C:\Users\Admin\AppData\Local\Temp\efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\agpmgr.exe"
  2⤵
  PID:1984
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:4324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wpasv.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wpasv.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wpasv.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\agpmgr.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\agpmgr.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1032
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
        5⤵
        
        PID:1324
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wpasv.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4184
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wpasv.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wpasv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "cmd /c C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wpasv.exe" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "cmd /c C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wpasv.exe" /f
        5⤵
        
        PID:840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wpasv.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\wpasv.exe.log
Size 128B
SHA256 e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5
MD5 a5dcc7c9c08af7dddd82be5b036a4416
SHA1 4f998ca1526d199e355ffb435bae111a2779b994
SHA512 56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a
MD5 SHA1 SHA512

Submit Download

agpmgr.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\agpmgr.exe
Size 522KB
SHA256 efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a
MD5 6bee3391e37c6e0715fbbae6a71de790
SHA1 f8fc14887d13a9df24558d3cc927d420d3fa36d5
SHA512 cc2e5cb0dfc28c3f75db938535962b67b96c2ffd8d1a1ea14d97f3790c84d844ed17b064722308edefe539f376ba556b3beb5660f4dda5e2551662a948027a2b
SSDEEP 12288:i6kHB9C+9s3WRQukIyYZcEzVzl4b4M05KxdlEGHuXmtbsL:q9sc2Ayq8001E6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

agpmgr.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\agpmgr.exe
Size 522KB
SHA256 efbca39b8b35dd46e0d5a81a275a6bc67c705240c27c8f293af91baafc8a9c5a
MD5 6bee3391e37c6e0715fbbae6a71de790
SHA1 f8fc14887d13a9df24558d3cc927d420d3fa36d5
SHA512 cc2e5cb0dfc28c3f75db938535962b67b96c2ffd8d1a1ea14d97f3790c84d844ed17b064722308edefe539f376ba556b3beb5660f4dda5e2551662a948027a2b
SSDEEP 12288:i6kHB9C+9s3WRQukIyYZcEzVzl4b4M05KxdlEGHuXmtbsL:q9sc2Ayq8001E6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpasv.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wpasv.exe
Size 13KB
SHA256 14a0de8abcb017017bb0990e9cc068cb72d339614727b0479795645ca678b980
MD5 1a606d51e1ed097e36d3731097ae0f54
SHA1 8cb97f5279ab807741c989b62a88c0819e2d7f74
SHA512 f0faba057b9649847b0507fdd9e91004f6a9988e6a6b823d586280f86902eebb38ba2c5ddc65229055acd280ff4b54878f72bf8f5f7fdd367a2bffa0cbed2d71
SSDEEP 192:XHMxiET5CqXjBC+/N/FxxCYxh9vzbOmALiDAgu1Bgy9gHJ:3M8W5DXVd//xxC8zbOmALiDAgKyH
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpasv.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wpasv.exe
Size 13KB
SHA256 14a0de8abcb017017bb0990e9cc068cb72d339614727b0479795645ca678b980
MD5 1a606d51e1ed097e36d3731097ae0f54
SHA1 8cb97f5279ab807741c989b62a88c0819e2d7f74
SHA512 f0faba057b9649847b0507fdd9e91004f6a9988e6a6b823d586280f86902eebb38ba2c5ddc65229055acd280ff4b54878f72bf8f5f7fdd367a2bffa0cbed2d71
SSDEEP 192:XHMxiET5CqXjBC+/N/FxxCYxh9vzbOmALiDAgu1Bgy9gHJ:3M8W5DXVd//xxC8zbOmALiDAgKyH
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpasv.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wpasv.exe
Size 13KB
SHA256 14a0de8abcb017017bb0990e9cc068cb72d339614727b0479795645ca678b980
MD5 1a606d51e1ed097e36d3731097ae0f54
SHA1 8cb97f5279ab807741c989b62a88c0819e2d7f74
SHA512 f0faba057b9649847b0507fdd9e91004f6a9988e6a6b823d586280f86902eebb38ba2c5ddc65229055acd280ff4b54878f72bf8f5f7fdd367a2bffa0cbed2d71
SSDEEP 192:XHMxiET5CqXjBC+/N/FxxCYxh9vzbOmALiDAgu1Bgy9gHJ:3M8W5DXVd//xxC8zbOmALiDAgKyH
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpasv.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wpasv.exe
Size 13KB
SHA256 14a0de8abcb017017bb0990e9cc068cb72d339614727b0479795645ca678b980
MD5 1a606d51e1ed097e36d3731097ae0f54
SHA1 8cb97f5279ab807741c989b62a88c0819e2d7f74
SHA512 f0faba057b9649847b0507fdd9e91004f6a9988e6a6b823d586280f86902eebb38ba2c5ddc65229055acd280ff4b54878f72bf8f5f7fdd367a2bffa0cbed2d71
SSDEEP 192:XHMxiET5CqXjBC+/N/FxxCYxh9vzbOmALiDAgu1Bgy9gHJ:3M8W5DXVd//xxC8zbOmALiDAgKyH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1032-151-0x00000000747D0000-0x0000000074D81000-memory.dmp

Download

memory/1032-149-0x00000000747D0000-0x0000000074D81000-memory.dmp

Download

memory/2312-148-0x00000000747D0000-0x0000000074D81000-memory.dmp

Download

memory/2312-150-0x00000000747D0000-0x0000000074D81000-memory.dmp

Download

memory/2312-153-0x00000000747D0000-0x0000000074D81000-memory.dmp

Download

memory/2940-164-0x00000000747D0000-0x0000000074D81000-memory.dmp

Download

memory/2940-163-0x00000000747D0000-0x0000000074D81000-memory.dmp

Download

memory/4288-132-0x00000000747D0000-0x0000000074D81000-memory.dmp

Download

memory/4288-133-0x00000000747D0000-0x0000000074D81000-memory.dmp

Download

memory/4288-152-0x00000000747D0000-0x0000000074D81000-memory.dmp

Download

memory/4324-137-0x0000000000170000-0x00000000001B2000-memory.dmp

Download