isrstealer | 963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7

General

Target

963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe
Size

395KB
MD5

c95ed3586c26a3aa263dc5651fce813d
SHA1

8e172e7204efcf6c5c04b8e2c9137b7871c762d3
SHA256

963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7
SHA512

0988bae3dedb12061fa76eeb2c40d8e5e136fc0be3fccb3cf7a4c0190c3ba9c7eb571ce532a04fafb5557131850c826aefb27fd33959172b675786c236c0fca5
SSDEEP

12288:tFUrJodto5cK9HR/otQt/RKgZCHgOyUGp2AaPCwyz:bQ4WcK9WtQtbs0YApt

Score

10^/10

isrstealer stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/4892-134-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4892-136-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4892-144-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4892-145-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2180 set thread context of 4892	2180	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	81
PID 4892 set thread context of 2416	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	82
PID 4892 set thread context of 2868	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	89

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3768	2416	WerFault.exe	82
4536	2868	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2180	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe
2180	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 4892	2180	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	81
PID 2180 wrote to memory of 4892	2180	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	81
PID 2180 wrote to memory of 4892	2180	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	81
PID 2180 wrote to memory of 4892	2180	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	81
PID 2180 wrote to memory of 4892	2180	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	81
PID 2180 wrote to memory of 4892	2180	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	81
PID 2180 wrote to memory of 4892	2180	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	81
PID 4892 wrote to memory of 2416	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	82
PID 4892 wrote to memory of 2416	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	82
PID 4892 wrote to memory of 2416	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	82
PID 4892 wrote to memory of 2416	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	82
PID 4892 wrote to memory of 2416	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	82
PID 4892 wrote to memory of 2416	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	82
PID 4892 wrote to memory of 2416	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	82
PID 4892 wrote to memory of 2416	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	82
PID 4892 wrote to memory of 2868	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	89
PID 4892 wrote to memory of 2868	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	89
PID 4892 wrote to memory of 2868	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	89
PID 4892 wrote to memory of 2868	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	89
PID 4892 wrote to memory of 2868	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	89
PID 4892 wrote to memory of 2868	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	89
PID 4892 wrote to memory of 2868	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	89
PID 4892 wrote to memory of 2868	4892	963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe	89

C:\Users\Admin\AppData\Local\Temp\963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe
"C:\Users\Admin\AppData\Local\Temp\963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe
  "C:\Users\Admin\AppData\Local\Temp\963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Users\Admin\AppData\Local\Temp\963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\pahawlpTjM.ini"
    3⤵
    PID:2416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 80
      4⤵
      Program crash
      PID:3768
- - C:\Users\Admin\AppData\Local\Temp\963adbb43d91a82c9c1fd515ede8591c7f9d8921fbfdf9e1e8186ce012d748b7.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\0ACZFFpC0L.ini"
    3⤵
    PID:2868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 80
      4⤵
      Program crash
      PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2416 -ip 2416
1⤵
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2868 -ip 2868
1⤵
PID:2788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-132-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download
memory/2180-137-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download
memory/4892-134-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4892-136-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4892-144-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4892-145-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing