isrstealer | c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a

Analysis

max time kernel
196s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 11:39

Target

c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a.exe
Size

322KB
MD5

b0d591714fd57b2f69e66a3b0a5987e7
SHA1

8a9a7f5c3d282c426becf850f882ea98ecc3e077
SHA256

c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a
SHA512

6e9076044cacf50f2baeb2ab011ab325566fdfcbbc63ef112a9f39808271230b82f9b76536887f5ae516a21e4d81ff06e613b726718d2df2c3b3164f60b327e6
SSDEEP

6144:O09bHgsZ4nQhu7mVBdKhV2hIEh4zz8DfIAZW8yYD7eADPQNIbmKx:prBh5BdKv2yk40LIWNG0L

Score

10^/10

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/3252-136-0x0000000000390000-0x00000000003D2000-memory.dmp	family_isrstealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5020 set thread context of 3252	5020	c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a.exe	84

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5020	c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 3252	5020	c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a.exe	84
PID 5020 wrote to memory of 3252	5020	c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a.exe	84
PID 5020 wrote to memory of 3252	5020	c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a.exe	84
PID 5020 wrote to memory of 3252	5020	c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a.exe	84
PID 5020 wrote to memory of 3252	5020	c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a.exe	84
PID 5020 wrote to memory of 3252	5020	c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a.exe	84
PID 5020 wrote to memory of 3252	5020	c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a.exe	84

C:\Users\Admin\AppData\Local\Temp\c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a.exe
"C:\Users\Admin\AppData\Local\Temp\c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a.exe
  "C:\Users\Admin\AppData\Local\Temp\c299df78fc3a4bedcea46d323e4218c871fba4b249225e6193ac10a9d49abb1a.exe"
  2⤵
  PID:3252

memory/3252-136-0x0000000000390000-0x00000000003D2000-memory.dmp

Filesize
264KB

Download
memory/5020-132-0x0000000074DE0000-0x0000000075391000-memory.dmp

Filesize
5.7MB

Download
memory/5020-133-0x0000000074DE0000-0x0000000075391000-memory.dmp

Filesize
5.7MB

Download
memory/5020-138-0x0000000074DE0000-0x0000000075391000-memory.dmp

Filesize
5.7MB

Download