Overview

overview

10

Static

static

9306afa147...9a.exe

windows7-x64

10

9306afa147...9a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a

  • Size

    1.0MB

  • Sample

    221128-sqmvesha4z

  • MD5

    749a7b99749d220936b95fb6e4132bd8

  • SHA1

    8e518cc998d1fdf6978a9d283cc3f443fe87c8f0

  • SHA256

    9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a

  • SHA512

    75c63302c82e827272266049ac34da50f74e971ad7c48cbe53e580317c8af099c03ebe5911ee4255366823e29365d4db433d8ca458244330c14588c0073cfdc2

  • SSDEEP

    24576:wfna/BVJI9Z+9zlmSzFpIS+1ASkw1okKIY2AyWuBAhE9QdB1d:wfuduKzlmSzFWS+10w1I3yWY3QL/

Score
10/10
isrstealercollectionevasionstealertrojanupx

Malware Config

Targets

    • Target

      9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a

    • Size

      1.0MB

    • MD5

      749a7b99749d220936b95fb6e4132bd8

    • SHA1

      8e518cc998d1fdf6978a9d283cc3f443fe87c8f0

    • SHA256

      9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a

    • SHA512

      75c63302c82e827272266049ac34da50f74e971ad7c48cbe53e580317c8af099c03ebe5911ee4255366823e29365d4db433d8ca458244330c14588c0073cfdc2

    • SSDEEP

      24576:wfna/BVJI9Z+9zlmSzFpIS+1ASkw1okKIY2AyWuBAhE9QdB1d:wfuduKzlmSzFWS+10w1I3yWY3QL/

    Score
    10/10
    isrstealercollectionevasionstealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Bypass User Account Control

1
T1088

Scheduled Task

1
T1053

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

2
T1089

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks