Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/11/2022, 07:56
Static task
static1
Behavioral task
behavioral1
Sample
38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe
Resource
win10v2004-20221111-en
General
-
Target
38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe
-
Size
420KB
-
MD5
3f22d23607e4bdaa606f3bc05c4e7d40
-
SHA1
70b913508d11009f241c2e948d337a750b654faa
-
SHA256
38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2
-
SHA512
42a824b4465f42003e030cf109472fa14668e3ed9f1bb1c132eb6c22bbf2c05a79ec7f28f7d49ac9466eab987eef3edce471e7e99b50896891bb1da112e0c0bd
-
SSDEEP
6144:lI3F3FgcxNJZAX0bK9FMBLPeW41I10fTEEPlCg0p1/:lIVVgcxNJZAkjpSYEt01/
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 4 IoCs
resource yara_rule behavioral1/memory/1628-62-0x0000000000400000-0x0000000000439000-memory.dmp family_isrstealer behavioral1/memory/1628-63-0x0000000000401110-mapping.dmp family_isrstealer behavioral1/memory/1628-66-0x0000000000400000-0x0000000000439000-memory.dmp family_isrstealer behavioral1/memory/1628-68-0x0000000000400000-0x0000000000439000-memory.dmp family_isrstealer -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 756 set thread context of 1628 756 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 976 1628 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 756 wrote to memory of 1628 756 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 28 PID 756 wrote to memory of 1628 756 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 28 PID 756 wrote to memory of 1628 756 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 28 PID 756 wrote to memory of 1628 756 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 28 PID 756 wrote to memory of 1628 756 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 28 PID 756 wrote to memory of 1628 756 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 28 PID 756 wrote to memory of 1628 756 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 28 PID 756 wrote to memory of 1628 756 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 28 PID 756 wrote to memory of 1628 756 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 28 PID 756 wrote to memory of 1628 756 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 28 PID 756 wrote to memory of 1628 756 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 28 PID 1628 wrote to memory of 976 1628 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 29 PID 1628 wrote to memory of 976 1628 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 29 PID 1628 wrote to memory of 976 1628 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 29 PID 1628 wrote to memory of 976 1628 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe"C:\Users\Admin\AppData\Local\Temp\38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe"C:\Users\Admin\AppData\Local\Temp\38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 1163⤵
- Program crash
PID:976
-
-