isrstealer | 73b1ba0355d45ddbaf61331ae75d0cb5407abc0099d1b61d12a69ae8e390f413

Analysis

max time kernel
135s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 11:18

Target
73b1ba0355d45ddbaf61331ae75d0cb5407abc0099d1b61d12a69ae8e390f413.exe
Size 361KB
Sample221106-neqdysbecm
SHA256 73b1ba0355d45ddbaf61331ae75d0cb5407abc0099d1b61d12a69ae8e390f413
MD5 fcfac837f8bc438090055bf1c8adc675
SHA1 f5df70e8ce133dd393881e4905b9aec4347e1ee6
SHA512 85e4bde9605032a0809cb3e4f9109d0e5f46fac51ed92302a9623b254b00c484a77f588e90a74f014f553d426e4b25fca1bd365c28c39557364cc7f6b39737c9
SSDEEP 6144:pkU1ampKEpqs2WSH8EP6BEWCdrYnP9B2ZxrLTVoKYMvRAS5zz+Tv1:p3KEUs2WZKYP2DnTyZMvRLl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/3180-136-0x0000000000610000-0x0000000000652000-memory.dmp	family_isrstealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4440 set thread context of 3180	4440	73b1ba0355d45ddbaf61331ae75d0cb5407abc0099d1b61d12a69ae8e390f413.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	73b1ba0355d45ddbaf61331ae75d0cb5407abc0099d1b61d12a69ae8e390f413.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 3180	4440	73b1ba0355d45ddbaf61331ae75d0cb5407abc0099d1b61d12a69ae8e390f413.exe	81
PID 4440 wrote to memory of 3180	4440	73b1ba0355d45ddbaf61331ae75d0cb5407abc0099d1b61d12a69ae8e390f413.exe	81
PID 4440 wrote to memory of 3180	4440	73b1ba0355d45ddbaf61331ae75d0cb5407abc0099d1b61d12a69ae8e390f413.exe	81
PID 4440 wrote to memory of 3180	4440	73b1ba0355d45ddbaf61331ae75d0cb5407abc0099d1b61d12a69ae8e390f413.exe	81
PID 4440 wrote to memory of 3180	4440	73b1ba0355d45ddbaf61331ae75d0cb5407abc0099d1b61d12a69ae8e390f413.exe	81
PID 4440 wrote to memory of 3180	4440	73b1ba0355d45ddbaf61331ae75d0cb5407abc0099d1b61d12a69ae8e390f413.exe	81
PID 4440 wrote to memory of 3180	4440	73b1ba0355d45ddbaf61331ae75d0cb5407abc0099d1b61d12a69ae8e390f413.exe	81

C:\Users\Admin\AppData\Local\Temp\73b1ba0355d45ddbaf61331ae75d0cb5407abc0099d1b61d12a69ae8e390f413.exe
"C:\Users\Admin\AppData\Local\Temp\73b1ba0355d45ddbaf61331ae75d0cb5407abc0099d1b61d12a69ae8e390f413.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:3180

memory/3180-136-0x0000000000610000-0x0000000000652000-memory.dmp

Download

memory/4440-132-0x0000000074880000-0x0000000074E31000-memory.dmp

Download

memory/4440-133-0x0000000074880000-0x0000000074E31000-memory.dmp

Download

memory/4440-138-0x0000000074880000-0x0000000074E31000-memory.dmp

Download