isrstealer | 79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf

Analysis

max time kernel
193s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
Size

356KB
MD5

f88adb471749bf8d81a8cf4f751cfa33
SHA1

9cfad677c8cdecab5292fceab6336d186cf12c11
SHA256

79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf
SHA512

85656a691ab29fa70d7ae048720ad41be2d901980885237d74d851bcdc3628b6a407f1cb2a672dbb271650b73439eccea5286aaf767be3a7902c035274bc371d
SSDEEP

6144:If4c9En/SYAnpq8D6jtl7jYH3xgPRy1RbHmlwfyJvP:IAP4n8re36o1R5fy5

Score

10^/10

isrstealer persistence stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/1476-59-0x0000000000100000-0x0000000000142000-memory.dmp	family_isrstealer
behavioral1/memory/1476-62-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral1/memory/1476-63-0x0000000000100000-0x0000000000142000-memory.dmp	family_isrstealer
behavioral1/memory/1816-90-0x0000000000401180-mapping.dmp	family_isrstealer

Executes dropped EXE 4 IoCs

pid	Process
1480	WUDHost.exe
640	Acctres.exe
1044	WUDHost.exe
1816	Acctres.exe

Loads dropped DLL 2 IoCs

pid	Process
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
1480	WUDHost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe"	WUDHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe"	WUDHost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 960 set thread context of 1476	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	28
PID 640 set thread context of 1816	640	Acctres.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
1480	WUDHost.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
1480	WUDHost.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
1480	WUDHost.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
1480	WUDHost.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
1480	WUDHost.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
1480	WUDHost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
Token: SeDebugPrivilege	1480	WUDHost.exe
Token: SeDebugPrivilege	640	Acctres.exe
Token: SeDebugPrivilege	1044	WUDHost.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1476	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	28
PID 960 wrote to memory of 1476	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	28
PID 960 wrote to memory of 1476	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	28
PID 960 wrote to memory of 1476	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	28
PID 960 wrote to memory of 1476	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	28
PID 960 wrote to memory of 1476	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	28
PID 960 wrote to memory of 1476	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	28
PID 960 wrote to memory of 1476	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	28
PID 960 wrote to memory of 1480	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	29
PID 960 wrote to memory of 1480	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	29
PID 960 wrote to memory of 1480	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	29
PID 960 wrote to memory of 1480	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	29
PID 1480 wrote to memory of 640	1480	WUDHost.exe	30
PID 1480 wrote to memory of 640	1480	WUDHost.exe	30
PID 1480 wrote to memory of 640	1480	WUDHost.exe	30
PID 1480 wrote to memory of 640	1480	WUDHost.exe	30
PID 960 wrote to memory of 1044	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	31
PID 960 wrote to memory of 1044	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	31
PID 960 wrote to memory of 1044	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	31
PID 960 wrote to memory of 1044	960	79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe	31
PID 640 wrote to memory of 1816	640	Acctres.exe	32
PID 640 wrote to memory of 1816	640	Acctres.exe	32
PID 640 wrote to memory of 1816	640	Acctres.exe	32
PID 640 wrote to memory of 1816	640	Acctres.exe	32
PID 640 wrote to memory of 1816	640	Acctres.exe	32
PID 640 wrote to memory of 1816	640	Acctres.exe	32
PID 640 wrote to memory of 1816	640	Acctres.exe	32
PID 640 wrote to memory of 1816	640	Acctres.exe	32

C:\Users\Admin\AppData\Local\Temp\79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
"C:\Users\Admin\AppData\Local\Temp\79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe
  "C:\Users\Admin\AppData\Local\Temp\79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf.exe"
  2⤵
  PID:1476
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
      4⤵
      Executes dropped EXE
      PID:1816
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
356KB

MD5
f88adb471749bf8d81a8cf4f751cfa33

SHA1
9cfad677c8cdecab5292fceab6336d186cf12c11

SHA256
79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf

SHA512
85656a691ab29fa70d7ae048720ad41be2d901980885237d74d851bcdc3628b6a407f1cb2a672dbb271650b73439eccea5286aaf767be3a7902c035274bc371d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
356KB

MD5
f88adb471749bf8d81a8cf4f751cfa33

SHA1
9cfad677c8cdecab5292fceab6336d186cf12c11

SHA256
79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf

SHA512
85656a691ab29fa70d7ae048720ad41be2d901980885237d74d851bcdc3628b6a407f1cb2a672dbb271650b73439eccea5286aaf767be3a7902c035274bc371d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
356KB

MD5
f88adb471749bf8d81a8cf4f751cfa33

SHA1
9cfad677c8cdecab5292fceab6336d186cf12c11

SHA256
79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf

SHA512
85656a691ab29fa70d7ae048720ad41be2d901980885237d74d851bcdc3628b6a407f1cb2a672dbb271650b73439eccea5286aaf767be3a7902c035274bc371d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
11KB

MD5
6250064b24fd9175bdad1c147fe6f209

SHA1
9c777e8318c8967625a829551ce561453d88e964

SHA256
933fa76fbbaff480ee54c270901ded9da46b417502bd3e4062580a54f0a68084

SHA512
3db783ef0fb348cf9a354052f8f0e907bc91b6b5bf807aea22731f5710e81f0af1a44c29434fa9169187077e941a1990f57ba0ab10c51a5243bb67fcb57d0f48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
11KB

MD5
6250064b24fd9175bdad1c147fe6f209

SHA1
9c777e8318c8967625a829551ce561453d88e964

SHA256
933fa76fbbaff480ee54c270901ded9da46b417502bd3e4062580a54f0a68084

SHA512
3db783ef0fb348cf9a354052f8f0e907bc91b6b5bf807aea22731f5710e81f0af1a44c29434fa9169187077e941a1990f57ba0ab10c51a5243bb67fcb57d0f48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
11KB

MD5
6250064b24fd9175bdad1c147fe6f209

SHA1
9c777e8318c8967625a829551ce561453d88e964

SHA256
933fa76fbbaff480ee54c270901ded9da46b417502bd3e4062580a54f0a68084

SHA512
3db783ef0fb348cf9a354052f8f0e907bc91b6b5bf807aea22731f5710e81f0af1a44c29434fa9169187077e941a1990f57ba0ab10c51a5243bb67fcb57d0f48

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
356KB

MD5
f88adb471749bf8d81a8cf4f751cfa33

SHA1
9cfad677c8cdecab5292fceab6336d186cf12c11

SHA256
79fcf6cfd0bf20b536c61dc493dd3db116eb82230699a821eb80bf310befdecf

SHA512
85656a691ab29fa70d7ae048720ad41be2d901980885237d74d851bcdc3628b6a407f1cb2a672dbb271650b73439eccea5286aaf767be3a7902c035274bc371d

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
11KB

MD5
6250064b24fd9175bdad1c147fe6f209

SHA1
9c777e8318c8967625a829551ce561453d88e964

SHA256
933fa76fbbaff480ee54c270901ded9da46b417502bd3e4062580a54f0a68084

SHA512
3db783ef0fb348cf9a354052f8f0e907bc91b6b5bf807aea22731f5710e81f0af1a44c29434fa9169187077e941a1990f57ba0ab10c51a5243bb67fcb57d0f48

Download Submit
memory/640-78-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/640-77-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/960-54-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/960-55-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/1044-83-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/1044-94-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/1476-63-0x0000000000100000-0x0000000000142000-memory.dmp

Filesize
264KB

Download
memory/1476-59-0x0000000000100000-0x0000000000142000-memory.dmp

Filesize
264KB

Download
memory/1476-57-0x0000000000100000-0x0000000000142000-memory.dmp

Filesize
264KB

Download
memory/1476-56-0x0000000000100000-0x0000000000142000-memory.dmp

Filesize
264KB

Download
memory/1480-71-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/1480-70-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/1480-79-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download