isrstealer | 135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae

General

Target

135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe
Size

283KB
MD5

2ba128fc308441e761ac3e5872e5e0a2
SHA1

8aafa7a13aa0f512fb2dab1764dd952c4b036878
SHA256

135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae
SHA512

8ec3958e62a6798bc9bb3d8da07e21ebd649a5ebec0358c1d507343735aa57762f343ebe78f8aa75fbb7bfcd6bfda22e96f95f136124f8b008b519413d691b9f
SSDEEP

6144:2VDKtNH8DLIYbeAV6lLsV7TA4JMgPwShfQcEqzhpioa3tM:sutx8DLIYbdGgI6f6qzhpba2

Score

10^/10

isrstealer spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/1996-62-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral1/memory/1996-60-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral1/memory/1996-76-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/952-74-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/952-75-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/952-70-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/952-77-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 536 set thread context of 1996	536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	29
PID 1996 set thread context of 952	1996	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1996	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 836	536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	27
PID 536 wrote to memory of 836	536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	27
PID 536 wrote to memory of 836	536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	27
PID 536 wrote to memory of 836	536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	27
PID 536 wrote to memory of 1996	536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	29
PID 536 wrote to memory of 1996	536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	29
PID 536 wrote to memory of 1996	536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	29
PID 536 wrote to memory of 1996	536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	29
PID 536 wrote to memory of 1996	536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	29
PID 536 wrote to memory of 1996	536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	29
PID 536 wrote to memory of 1996	536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	29
PID 536 wrote to memory of 1996	536	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	29
PID 1996 wrote to memory of 952	1996	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	28
PID 1996 wrote to memory of 952	1996	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	28
PID 1996 wrote to memory of 952	1996	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	28
PID 1996 wrote to memory of 952	1996	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	28
PID 1996 wrote to memory of 952	1996	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	28
PID 1996 wrote to memory of 952	1996	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	28
PID 1996 wrote to memory of 952	1996	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	28
PID 1996 wrote to memory of 952	1996	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	28
PID 1996 wrote to memory of 952	1996	135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe	28

C:\Users\Admin\AppData\Local\Temp\135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe
"C:\Users\Admin\AppData\Local\Temp\135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536
- C:\Users\Admin\AppData\Local\Temp\135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe
  "C:\Users\Admin\AppData\Local\Temp\135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe"
  2⤵
  PID:836
- C:\Users\Admin\AppData\Local\Temp\135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe
  "C:\Users\Admin\AppData\Local\Temp\135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1996

C:\Users\Admin\AppData\Local\Temp\135f7ef114afc711cf3af9d8cb7014cf2f9961b3f0d8da9c68a79da4d49c10ae.exe
/scomma "C:\Users\Admin\AppData\Local\Temp\kmGUUJa1ZK.ini"
1⤵
PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-67-0x0000000075000000-0x00000000755AB000-memory.dmp

Filesize
5.7MB

Download
memory/536-55-0x0000000075000000-0x00000000755AB000-memory.dmp

Filesize
5.7MB

Download
memory/536-56-0x0000000075000000-0x00000000755AB000-memory.dmp

Filesize
5.7MB

Download
memory/536-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/952-77-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/952-74-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/952-75-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/952-70-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1996-68-0x0000000000120000-0x000000000017F000-memory.dmp

Filesize
380KB

Download
memory/1996-62-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1996-60-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1996-58-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1996-57-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1996-76-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing