isrstealer | 2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f

Analysis

max time kernel
35s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe
Size

156KB
MD5

8115772851e1fdcf57a48d4b8d4c12fe
SHA1

35da657f12a22c2bb8773ba0a4e3e8dff0af4e53
SHA256

2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f
SHA512

406d7268d5ddd7d9a964a4acd6fa8c39e15d3465b55192c3c768dafccfb2fb5dc689c5ccf73dd31acc44329c9c227b77e32c8eebb56ca7c4b7bc248e25e890db
SSDEEP

3072:M1wyHU/zhrXhGoFwrTgj7obINT3guCvp3BMs:MIzhrXhGoyrMPobUT3LCvp3BM

Score

10^/10

isrstealer bootkit persistence spyware stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 7 IoCs

resource	yara_rule
behavioral1/memory/1984-59-0x0000000000400000-0x000000000040F000-memory.dmp	family_isrstealer
behavioral1/memory/1984-60-0x0000000000400000-0x000000000040F000-memory.dmp	family_isrstealer
behavioral1/memory/1984-61-0x00000000004011C8-mapping.dmp	family_isrstealer
behavioral1/memory/1984-67-0x0000000000400000-0x000000000040F000-memory.dmp	family_isrstealer
behavioral1/memory/1984-75-0x0000000000400000-0x000000000040F000-memory.dmp	family_isrstealer
behavioral1/memory/1108-82-0x00000000004011C8-mapping.dmp	family_isrstealer
behavioral1/memory/1108-94-0x0000000000400000-0x000000000040F000-memory.dmp	family_isrstealer

Executes dropped EXE 2 IoCs

pid	Process
816	service.exe
1108	service.exe

Deletes itself 1 IoCs

pid	Process
1956	cmd.exe

Loads dropped DLL 7 IoCs

pid	Process
1984	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe
1984	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\service.exe = "C:\\Users\\Admin\\AppData\\Roaming\\service.exe"	service.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\service.exe = "C:\\Users\\Admin\\AppData\\Roaming\\service.exe"	service.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	service.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe
File opened for modification	\??\PhysicalDrive0	service.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1160 set thread context of 1984	1160	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	26
PID 816 set thread context of 1108	816	service.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
584	1108	WerFault.exe	30

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1160	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe
1984	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe
816	service.exe
1108	service.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1984	1160	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	26
PID 1160 wrote to memory of 1984	1160	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	26
PID 1160 wrote to memory of 1984	1160	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	26
PID 1160 wrote to memory of 1984	1160	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	26
PID 1160 wrote to memory of 1984	1160	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	26
PID 1160 wrote to memory of 1984	1160	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	26
PID 1160 wrote to memory of 1984	1160	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	26
PID 1160 wrote to memory of 1984	1160	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	26
PID 1984 wrote to memory of 1956	1984	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	27
PID 1984 wrote to memory of 1956	1984	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	27
PID 1984 wrote to memory of 1956	1984	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	27
PID 1984 wrote to memory of 1956	1984	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	27
PID 1984 wrote to memory of 816	1984	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	29
PID 1984 wrote to memory of 816	1984	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	29
PID 1984 wrote to memory of 816	1984	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	29
PID 1984 wrote to memory of 816	1984	2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe	29
PID 816 wrote to memory of 1108	816	service.exe	30
PID 816 wrote to memory of 1108	816	service.exe	30
PID 816 wrote to memory of 1108	816	service.exe	30
PID 816 wrote to memory of 1108	816	service.exe	30
PID 816 wrote to memory of 1108	816	service.exe	30
PID 816 wrote to memory of 1108	816	service.exe	30
PID 816 wrote to memory of 1108	816	service.exe	30
PID 816 wrote to memory of 1108	816	service.exe	30
PID 1108 wrote to memory of 584	1108	service.exe	31
PID 1108 wrote to memory of 584	1108	service.exe	31
PID 1108 wrote to memory of 584	1108	service.exe	31
PID 1108 wrote to memory of 584	1108	service.exe	31

C:\Users\Admin\AppData\Local\Temp\2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe
"C:\Users\Admin\AppData\Local\Temp\2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe
  "C:\Users\Admin\AppData\Local\Temp\2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\melt1.bat
    3⤵
    - Deletes itself
    PID:1956
- - C:\Users\Admin\AppData\Roaming\service.exe
    "C:\Users\Admin\AppData\Roaming\service.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Users\Admin\AppData\Roaming\service.exe
      "C:\Users\Admin\AppData\Roaming\service.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1108
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 408
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\melt1.bat

Filesize
321B

MD5
51780a39adb02e48591523154ae6a7f7

SHA1
5ba0cb2b0e85d8d06f419c1ead882a391bebfdfd

SHA256
60c5462d2b7b8f1a46fa174d435a57df6cd0fd4a7963139debd8870379185e40

SHA512
516fb0be17358c5ea3c602e12ec52e63474abc739f1d12df015d09c70247195f0e462e937a0341d46377ee025b212f3c96cb051e73549b9e8a7ac6908c3f7b3d

Download Submit
C:\Users\Admin\AppData\Roaming\service.exe

Filesize
156KB

MD5
8115772851e1fdcf57a48d4b8d4c12fe

SHA1
35da657f12a22c2bb8773ba0a4e3e8dff0af4e53

SHA256
2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f

SHA512
406d7268d5ddd7d9a964a4acd6fa8c39e15d3465b55192c3c768dafccfb2fb5dc689c5ccf73dd31acc44329c9c227b77e32c8eebb56ca7c4b7bc248e25e890db

Download Submit
C:\Users\Admin\AppData\Roaming\service.exe

Filesize
156KB

MD5
8115772851e1fdcf57a48d4b8d4c12fe

SHA1
35da657f12a22c2bb8773ba0a4e3e8dff0af4e53

SHA256
2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f

SHA512
406d7268d5ddd7d9a964a4acd6fa8c39e15d3465b55192c3c768dafccfb2fb5dc689c5ccf73dd31acc44329c9c227b77e32c8eebb56ca7c4b7bc248e25e890db

Download Submit
C:\Users\Admin\AppData\Roaming\service.exe

Filesize
156KB

MD5
8115772851e1fdcf57a48d4b8d4c12fe

SHA1
35da657f12a22c2bb8773ba0a4e3e8dff0af4e53

SHA256
2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f

SHA512
406d7268d5ddd7d9a964a4acd6fa8c39e15d3465b55192c3c768dafccfb2fb5dc689c5ccf73dd31acc44329c9c227b77e32c8eebb56ca7c4b7bc248e25e890db

Download Submit
\Users\Admin\AppData\Roaming\service.exe

Filesize
156KB

MD5
8115772851e1fdcf57a48d4b8d4c12fe

SHA1
35da657f12a22c2bb8773ba0a4e3e8dff0af4e53

SHA256
2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f

SHA512
406d7268d5ddd7d9a964a4acd6fa8c39e15d3465b55192c3c768dafccfb2fb5dc689c5ccf73dd31acc44329c9c227b77e32c8eebb56ca7c4b7bc248e25e890db

Download Submit
\Users\Admin\AppData\Roaming\service.exe

Filesize
156KB

MD5
8115772851e1fdcf57a48d4b8d4c12fe

SHA1
35da657f12a22c2bb8773ba0a4e3e8dff0af4e53

SHA256
2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f

SHA512
406d7268d5ddd7d9a964a4acd6fa8c39e15d3465b55192c3c768dafccfb2fb5dc689c5ccf73dd31acc44329c9c227b77e32c8eebb56ca7c4b7bc248e25e890db

Download Submit
\Users\Admin\AppData\Roaming\service.exe

Filesize
156KB

MD5
8115772851e1fdcf57a48d4b8d4c12fe

SHA1
35da657f12a22c2bb8773ba0a4e3e8dff0af4e53

SHA256
2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f

SHA512
406d7268d5ddd7d9a964a4acd6fa8c39e15d3465b55192c3c768dafccfb2fb5dc689c5ccf73dd31acc44329c9c227b77e32c8eebb56ca7c4b7bc248e25e890db

Download Submit
\Users\Admin\AppData\Roaming\service.exe

Filesize
156KB

MD5
8115772851e1fdcf57a48d4b8d4c12fe

SHA1
35da657f12a22c2bb8773ba0a4e3e8dff0af4e53

SHA256
2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f

SHA512
406d7268d5ddd7d9a964a4acd6fa8c39e15d3465b55192c3c768dafccfb2fb5dc689c5ccf73dd31acc44329c9c227b77e32c8eebb56ca7c4b7bc248e25e890db

Download Submit
\Users\Admin\AppData\Roaming\service.exe

Filesize
156KB

MD5
8115772851e1fdcf57a48d4b8d4c12fe

SHA1
35da657f12a22c2bb8773ba0a4e3e8dff0af4e53

SHA256
2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f

SHA512
406d7268d5ddd7d9a964a4acd6fa8c39e15d3465b55192c3c768dafccfb2fb5dc689c5ccf73dd31acc44329c9c227b77e32c8eebb56ca7c4b7bc248e25e890db

Download Submit
\Users\Admin\AppData\Roaming\service.exe

Filesize
156KB

MD5
8115772851e1fdcf57a48d4b8d4c12fe

SHA1
35da657f12a22c2bb8773ba0a4e3e8dff0af4e53

SHA256
2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f

SHA512
406d7268d5ddd7d9a964a4acd6fa8c39e15d3465b55192c3c768dafccfb2fb5dc689c5ccf73dd31acc44329c9c227b77e32c8eebb56ca7c4b7bc248e25e890db

Download Submit
\Users\Admin\AppData\Roaming\service.exe

Filesize
156KB

MD5
8115772851e1fdcf57a48d4b8d4c12fe

SHA1
35da657f12a22c2bb8773ba0a4e3e8dff0af4e53

SHA256
2adb40401a2e732139725aff2a4dc3e8b3ad8c08c197c1bb73313ee5a1539b9f

SHA512
406d7268d5ddd7d9a964a4acd6fa8c39e15d3465b55192c3c768dafccfb2fb5dc689c5ccf73dd31acc44329c9c227b77e32c8eebb56ca7c4b7bc248e25e890db

Download Submit
memory/1108-94-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1984-65-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/1984-56-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1984-60-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1984-59-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1984-57-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1984-75-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1984-67-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download