Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2022, 07:56
Static task
static1
Behavioral task
behavioral1
Sample
38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe
Resource
win10v2004-20221111-en
General
-
Target
38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe
-
Size
420KB
-
MD5
3f22d23607e4bdaa606f3bc05c4e7d40
-
SHA1
70b913508d11009f241c2e948d337a750b654faa
-
SHA256
38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2
-
SHA512
42a824b4465f42003e030cf109472fa14668e3ed9f1bb1c132eb6c22bbf2c05a79ec7f28f7d49ac9466eab987eef3edce471e7e99b50896891bb1da112e0c0bd
-
SSDEEP
6144:lI3F3FgcxNJZAX0bK9FMBLPeW41I10fTEEPlCg0p1/:lIVVgcxNJZAkjpSYEt01/
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 3 IoCs
resource yara_rule behavioral2/memory/404-134-0x0000000000400000-0x0000000000439000-memory.dmp family_isrstealer behavioral2/memory/404-136-0x0000000000400000-0x0000000000439000-memory.dmp family_isrstealer behavioral2/memory/404-137-0x0000000000400000-0x0000000000439000-memory.dmp family_isrstealer -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 604 set thread context of 2032 604 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 85 PID 2032 set thread context of 404 2032 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 86 -
Program crash 1 IoCs
pid pid_target Process procid_target 4068 404 WerFault.exe 86 -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 604 wrote to memory of 2032 604 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 85 PID 604 wrote to memory of 2032 604 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 85 PID 604 wrote to memory of 2032 604 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 85 PID 2032 wrote to memory of 404 2032 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 86 PID 2032 wrote to memory of 404 2032 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 86 PID 2032 wrote to memory of 404 2032 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 86 PID 2032 wrote to memory of 404 2032 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 86 PID 2032 wrote to memory of 404 2032 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 86 PID 2032 wrote to memory of 404 2032 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 86 PID 2032 wrote to memory of 404 2032 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 86 PID 2032 wrote to memory of 404 2032 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 86 PID 2032 wrote to memory of 404 2032 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 86 PID 2032 wrote to memory of 404 2032 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 86 PID 2032 wrote to memory of 404 2032 38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe"C:\Users\Admin\AppData\Local\Temp\38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Users\Admin\AppData\Local\Temp\38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe"C:\Users\Admin\AppData\Local\Temp\38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe"C:\Users\Admin\AppData\Local\Temp\38111d6455b0405d795939272278046b84ccd53af634e4a4c50d41a42e660cb2.exe"3⤵PID:404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 2964⤵
- Program crash
PID:4068
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 404 -ip 4041⤵PID:4604