Overview

overview

10

Static

static

7

51a2c02d9a...82.exe

windows7-x64

10

51a2c02d9a...82.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    157s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2022 08:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    51a2c02d9aa47645aa55345fef4f817eaeb816ba0c266efc029b56056d3d0a82.exe

  • Size

    372KB

  • MD5

    61037538e0174df60ad78e045896dd80

  • SHA1

    4901fdcdfd0d41aa0721c2d6f687c62c671cd687

  • SHA256

    51a2c02d9aa47645aa55345fef4f817eaeb816ba0c266efc029b56056d3d0a82

  • SHA512

    252ac724fdb4a6238d93ade5114788c8db1e7430f20d9c643a7c06ee657f3d87ba31bdb77f80fddc179affb066c5f64ef4d796e6db0c77c4ca245d1fb6d47931

  • SSDEEP

    6144:xYPaSjKP2wYla5OgXZ01kAkpHOrvn8MVyFmQ0dvMW8DX76xrXI2:GPlNLuLckpurvnjVGWD8776tI2

Score
10/10
isrstealeragilenetcollectionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    trojanstealerisrstealer
  • ISR Stealer payload 8 IoCs
  • NirSoft MailPassView 4 IoCs

    Password recovery tool for various email clients

  • Nirsoft 4 IoCs
  • Executes dropped EXE 6 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Obfuscated with Agile.Net obfuscator 5 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
    collection
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51a2c02d9aa47645aa55345fef4f817eaeb816ba0c266efc029b56056d3d0a82.exe
    "C:\Users\Admin\AppData\Local\Temp\51a2c02d9aa47645aa55345fef4f817eaeb816ba0c266efc029b56056d3d0a82.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:776
    • C:\Users\Admin\AppData\Local\Temp\51a2c02d9aa47645aa55345fef4f817eaeb816ba0c266efc029b56056d3d0a82.exe
      "C:\Users\Admin\AppData\Local\Temp\51a2c02d9aa47645aa55345fef4f817eaeb816ba0c266efc029b56056d3d0a82.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3120
      • C:\Users\Admin\AppData\Local\Temp\51a2c02d9aa47645aa55345fef4f817eaeb816ba0c266efc029b56056d3d0a82.exe
        /scomma "C:\Users\Admin\AppData\Local\Temp\kLtfnzrGfZ.ini"
        3⤵
          PID:4944
        • C:\Users\Admin\AppData\Local\Temp\51a2c02d9aa47645aa55345fef4f817eaeb816ba0c266efc029b56056d3d0a82.exe
          /scomma "C:\Users\Admin\AppData\Local\Temp\vbNYfsBSL0.ini"
          3⤵
          • Accesses Microsoft Outlook accounts
          PID:640
      • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1284
        • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe"
          3⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4324
          • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1488
            • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe
              /scomma "C:\Users\Admin\AppData\Local\Temp\pW29XBxwoa.ini"
              5⤵
              • Executes dropped EXE
              • Suspicious use of UnmapMainImage
              PID:5096
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 12
                6⤵
                • Program crash
                PID:5044
            • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe
              /scomma "C:\Users\Admin\AppData\Local\Temp\CeZq9JF6ke.ini"
              5⤵
              • Executes dropped EXE
              • Accesses Microsoft Outlook accounts
              PID:3896
          • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of AdjustPrivilegeToken
            PID:4948
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5096 -ip 5096
      1⤵
        PID:2624

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\wmiApSrv.exe.log
        Filesize

        224B

        MD5

        c19eb8c8e7a40e6b987f9d2ee952996e

        SHA1

        6fc3049855bc9100643e162511673c6df0f28bfb

        SHA256

        677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a

        SHA512

        860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\kLtfnzrGfZ.ini
        Filesize

        5B

        MD5

        d1ea279fb5559c020a1b4137dc4de237

        SHA1

        db6f8988af46b56216a6f0daf95ab8c9bdb57400

        SHA256

        fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

        SHA512

        720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe
        Filesize

        372KB

        MD5

        61037538e0174df60ad78e045896dd80

        SHA1

        4901fdcdfd0d41aa0721c2d6f687c62c671cd687

        SHA256

        51a2c02d9aa47645aa55345fef4f817eaeb816ba0c266efc029b56056d3d0a82

        SHA512

        252ac724fdb4a6238d93ade5114788c8db1e7430f20d9c643a7c06ee657f3d87ba31bdb77f80fddc179affb066c5f64ef4d796e6db0c77c4ca245d1fb6d47931

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe
        Filesize

        372KB

        MD5

        61037538e0174df60ad78e045896dd80

        SHA1

        4901fdcdfd0d41aa0721c2d6f687c62c671cd687

        SHA256

        51a2c02d9aa47645aa55345fef4f817eaeb816ba0c266efc029b56056d3d0a82

        SHA512

        252ac724fdb4a6238d93ade5114788c8db1e7430f20d9c643a7c06ee657f3d87ba31bdb77f80fddc179affb066c5f64ef4d796e6db0c77c4ca245d1fb6d47931

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe
        Filesize

        372KB

        MD5

        61037538e0174df60ad78e045896dd80

        SHA1

        4901fdcdfd0d41aa0721c2d6f687c62c671cd687

        SHA256

        51a2c02d9aa47645aa55345fef4f817eaeb816ba0c266efc029b56056d3d0a82

        SHA512

        252ac724fdb4a6238d93ade5114788c8db1e7430f20d9c643a7c06ee657f3d87ba31bdb77f80fddc179affb066c5f64ef4d796e6db0c77c4ca245d1fb6d47931

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe
        Filesize

        372KB

        MD5

        61037538e0174df60ad78e045896dd80

        SHA1

        4901fdcdfd0d41aa0721c2d6f687c62c671cd687

        SHA256

        51a2c02d9aa47645aa55345fef4f817eaeb816ba0c266efc029b56056d3d0a82

        SHA512

        252ac724fdb4a6238d93ade5114788c8db1e7430f20d9c643a7c06ee657f3d87ba31bdb77f80fddc179affb066c5f64ef4d796e6db0c77c4ca245d1fb6d47931

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe
        Filesize

        372KB

        MD5

        61037538e0174df60ad78e045896dd80

        SHA1

        4901fdcdfd0d41aa0721c2d6f687c62c671cd687

        SHA256

        51a2c02d9aa47645aa55345fef4f817eaeb816ba0c266efc029b56056d3d0a82

        SHA512

        252ac724fdb4a6238d93ade5114788c8db1e7430f20d9c643a7c06ee657f3d87ba31bdb77f80fddc179affb066c5f64ef4d796e6db0c77c4ca245d1fb6d47931

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe
        Filesize

        21KB

        MD5

        de87856e1fa24bc7ae8ed904a93dac3b

        SHA1

        77c3ef94946497c2b5002c8d41216b7d0a86b28d

        SHA256

        f8daf35872bb9903e5cc3fb19887eea6f9986de08ce954bdf867819230ca1bcd

        SHA512

        c86cbe9cfa3fffc6a059e822379968e670e09be72519b58fb3e7223a89bddb98c3f9f4a2b49f138ab18affa52f88b52f8cfe265ed8edff17ea1e8c36ade307b2

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe
        Filesize

        21KB

        MD5

        de87856e1fa24bc7ae8ed904a93dac3b

        SHA1

        77c3ef94946497c2b5002c8d41216b7d0a86b28d

        SHA256

        f8daf35872bb9903e5cc3fb19887eea6f9986de08ce954bdf867819230ca1bcd

        SHA512

        c86cbe9cfa3fffc6a059e822379968e670e09be72519b58fb3e7223a89bddb98c3f9f4a2b49f138ab18affa52f88b52f8cfe265ed8edff17ea1e8c36ade307b2

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe
        Filesize

        21KB

        MD5

        de87856e1fa24bc7ae8ed904a93dac3b

        SHA1

        77c3ef94946497c2b5002c8d41216b7d0a86b28d

        SHA256

        f8daf35872bb9903e5cc3fb19887eea6f9986de08ce954bdf867819230ca1bcd

        SHA512

        c86cbe9cfa3fffc6a059e822379968e670e09be72519b58fb3e7223a89bddb98c3f9f4a2b49f138ab18affa52f88b52f8cfe265ed8edff17ea1e8c36ade307b2

        Download Submit

      • memory/640-162-0x0000000000400000-0x000000000041F000-memory.dmp

        Filesize

        124KB

        Download

      • memory/640-161-0x0000000000400000-0x000000000041F000-memory.dmp

        Filesize

        124KB

        Download

      • memory/640-159-0x0000000000400000-0x000000000041F000-memory.dmp

        Filesize

        124KB

        Download

      • memory/640-163-0x0000000000400000-0x000000000041F000-memory.dmp

        Filesize

        124KB

        Download

      • memory/776-167-0x00000000751C0000-0x0000000075771000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/776-132-0x00000000751C0000-0x0000000075771000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/776-133-0x00000000751C0000-0x0000000075771000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/1284-150-0x00000000751C0000-0x0000000075771000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/1284-166-0x00000000751C0000-0x0000000075771000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/1284-153-0x00000000751C0000-0x0000000075771000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/1488-189-0x0000000000400000-0x0000000000442000-memory.dmp

        Filesize

        264KB

        Download

      • memory/1488-172-0x0000000000400000-0x0000000000442000-memory.dmp

        Filesize

        264KB

        Download

      • memory/1488-190-0x0000000000400000-0x0000000000442000-memory.dmp

        Filesize

        264KB

        Download

      • memory/3120-152-0x0000000000400000-0x0000000000442000-memory.dmp

        Filesize

        264KB

        Download

      • memory/3120-164-0x0000000000400000-0x0000000000442000-memory.dmp

        Filesize

        264KB

        Download

      • memory/3120-137-0x0000000000400000-0x0000000000442000-memory.dmp

        Filesize

        264KB

        Download

      • memory/3120-144-0x0000000000400000-0x0000000000442000-memory.dmp

        Filesize

        264KB

        Download

      • memory/3120-135-0x0000000000400000-0x0000000000442000-memory.dmp

        Filesize

        264KB

        Download

      • memory/3896-186-0x0000000000400000-0x000000000041F000-memory.dmp

        Filesize

        124KB

        Download

      • memory/3896-187-0x0000000000400000-0x000000000041F000-memory.dmp

        Filesize

        124KB

        Download

      • memory/3896-188-0x0000000000400000-0x000000000041F000-memory.dmp

        Filesize

        124KB

        Download

      • memory/4324-165-0x00000000751C0000-0x0000000075771000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/4324-157-0x00000000751C0000-0x0000000075771000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/4944-146-0x0000000000400000-0x0000000000453000-memory.dmp

        Filesize

        332KB

        Download

      • memory/4944-141-0x0000000000400000-0x0000000000453000-memory.dmp

        Filesize

        332KB

        Download

      • memory/4944-143-0x0000000000400000-0x0000000000453000-memory.dmp

        Filesize

        332KB

        Download

      • memory/4944-145-0x0000000000400000-0x0000000000453000-memory.dmp

        Filesize

        332KB

        Download

      • memory/4948-181-0x00000000751C0000-0x0000000075771000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/4948-191-0x00000000751C0000-0x0000000075771000-memory.dmp

        Filesize

        5.7MB

        Download