isrstealer | 0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36

Analysis

max time kernel
120s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2022 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe
Size

302KB
MD5

550b2de6efda3c987d936991de5aef80
SHA1

864920c84afefda5b9244a2b6dbc830ab6937dc1
SHA256

0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36
SHA512

a38fbd62e91bd88996bf301b5f6125e675b781b6d53b6da701592aeeac1413aea0fbdbebefc156c72e0160c3c0cc60c8982ebd99ed116f05b9c3946580386774
SSDEEP

6144:ticZCJTbwkBUbkh1Jeld/tajvoY6scY3o8vY3R2ZtfM:Ep2MUYh1AV7YPE8vrZtfM

Score

10^/10

isrstealer stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4960-135-0x0000000000760000-0x00000000007A2000-memory.dmp	family_isrstealer
behavioral2/memory/4240-140-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4240-146-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4240-149-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4240-150-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4996 set thread context of 4960	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	84
PID 4996 set thread context of 4240	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	85
PID 4240 set thread context of 1312	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	86
PID 4240 set thread context of 4268	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	90

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1504	1312	WerFault.exe	86
3420	4268	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe
4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe
4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe
4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe
4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe
4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 4960	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	84
PID 4996 wrote to memory of 4960	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	84
PID 4996 wrote to memory of 4960	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	84
PID 4996 wrote to memory of 4960	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	84
PID 4996 wrote to memory of 4960	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	84
PID 4996 wrote to memory of 4960	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	84
PID 4996 wrote to memory of 4960	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	84
PID 4996 wrote to memory of 4240	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	85
PID 4996 wrote to memory of 4240	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	85
PID 4996 wrote to memory of 4240	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	85
PID 4996 wrote to memory of 4240	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	85
PID 4996 wrote to memory of 4240	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	85
PID 4996 wrote to memory of 4240	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	85
PID 4996 wrote to memory of 4240	4996	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	85
PID 4240 wrote to memory of 1312	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	86
PID 4240 wrote to memory of 1312	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	86
PID 4240 wrote to memory of 1312	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	86
PID 4240 wrote to memory of 1312	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	86
PID 4240 wrote to memory of 1312	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	86
PID 4240 wrote to memory of 1312	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	86
PID 4240 wrote to memory of 1312	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	86
PID 4240 wrote to memory of 1312	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	86
PID 4240 wrote to memory of 4268	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	90
PID 4240 wrote to memory of 4268	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	90
PID 4240 wrote to memory of 4268	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	90
PID 4240 wrote to memory of 4268	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	90
PID 4240 wrote to memory of 4268	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	90
PID 4240 wrote to memory of 4268	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	90
PID 4240 wrote to memory of 4268	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	90
PID 4240 wrote to memory of 4268	4240	0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe	90

C:\Users\Admin\AppData\Local\Temp\0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe
"C:\Users\Admin\AppData\Local\Temp\0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe
  "C:\Users\Admin\AppData\Local\Temp\0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe"
  2⤵
  PID:4960
- C:\Users\Admin\AppData\Local\Temp\0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe
  "C:\Users\Admin\AppData\Local\Temp\0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Users\Admin\AppData\Local\Temp\0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\OWzTzXqTge.ini"
    3⤵
    PID:1312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 80
      4⤵
      Program crash
      PID:1504
- - C:\Users\Admin\AppData\Local\Temp\0a8862ed1ece092d9c418014075dfee131547629ff617bf62e52dbb3df8bca36.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\AERSgiA5dS.ini"
    3⤵
    PID:4268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 80
      4⤵
      Program crash
      PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1312 -ip 1312
1⤵
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4268 -ip 4268
1⤵
PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4240-140-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4240-146-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4240-149-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4240-150-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4960-135-0x0000000000760000-0x00000000007A2000-memory.dmp

Filesize
264KB

Download
memory/4996-132-0x00000000747D0000-0x0000000074D81000-memory.dmp

Filesize
5.7MB

Download
memory/4996-141-0x00000000747D0000-0x0000000074D81000-memory.dmp

Filesize
5.7MB

Download