isrstealer | e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31

Analysis

max time kernel
39s
max time network
60s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/11/2022, 21:12

Target

e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31.exe
Size

128KB
MD5

0e08f05220481c5bb663c686e41a7b30
SHA1

6210aaa0b306fa5cacb2a64230b52f38872200fe
SHA256

e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31
SHA512

4b9d934e34c4ce5d5aebaca15dead41a122ade985c8e709c47b0f81fd408213b92ad036728af97c8fc9b9221fa72cd2ee813967183d34c5985d198aac25205b6
SSDEEP

3072:Z90F8hieBtYp/5aUfRoyUQ3lBDqmOn4q23k:8FeiSYp/bRoTOlBm+

Score

10^/10

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/1656-60-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1656-61-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1656-62-0x00000000004011F0-mapping.dmp	family_isrstealer
behavioral1/memory/1656-69-0x0000000000401000-0x0000000000412000-memory.dmp	family_isrstealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 1656	1992	e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1656	AppLaunch.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1656	1992	e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31.exe	28
PID 1992 wrote to memory of 1656	1992	e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31.exe	28
PID 1992 wrote to memory of 1656	1992	e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31.exe	28
PID 1992 wrote to memory of 1656	1992	e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31.exe	28
PID 1992 wrote to memory of 1656	1992	e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31.exe	28
PID 1992 wrote to memory of 1656	1992	e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31.exe	28
PID 1992 wrote to memory of 1656	1992	e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31.exe	28
PID 1992 wrote to memory of 1656	1992	e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31.exe	28
PID 1992 wrote to memory of 1656	1992	e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31.exe	28
PID 1992 wrote to memory of 1656	1992	e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31.exe	28
PID 1992 wrote to memory of 1656	1992	e15153c2231b85dc486322f9bf97fd3d85274195184c027a63a0a05a099b9b31.exe	28

memory/1656-57-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1656-58-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1656-60-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1656-61-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1656-69-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/1992-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x00000000743D0000-0x000000007497B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-56-0x00000000743D0000-0x000000007497B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-63-0x00000000743D0000-0x000000007497B000-memory.dmp

Filesize
5.7MB

Download