isrstealer | 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe
Size

405KB
MD5

b76b66e61a86b4708d164f16a587b7eb
SHA1

002d8fc45341c61238d00136059aa64eaef44d22
SHA256

3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20
SHA512

bc47f19345908ad06679e4bf729eb623b15173079a0f828f62de2be1c5ae6ab21cde0633baf93db237e6e91085e508f29c3acddd7fbfc2fe7b8d333adccfc9ff
SSDEEP

6144:2UwHuNnp2M8TJCJkI/Y8PJw1nQ5orsV7qsmgFB/pAeEURLHcc04TU:rt2M8Tln3wYsmgFh8UFK1

Score

10^/10

isrstealer stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/3588-134-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/3588-136-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/3588-142-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/3588-145-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1016 set thread context of 3588	1016	3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe	80
PID 3588 set thread context of 392	3588	RegSvcs.exe	81
PID 3588 set thread context of 3312	3588	RegSvcs.exe	85

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4580	392	WerFault.exe	81
1684	3312	WerFault.exe	85

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3588	RegSvcs.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 3588	1016	3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe	80
PID 1016 wrote to memory of 3588	1016	3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe	80
PID 1016 wrote to memory of 3588	1016	3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe	80
PID 1016 wrote to memory of 3588	1016	3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe	80
PID 1016 wrote to memory of 3588	1016	3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe	80
PID 1016 wrote to memory of 3588	1016	3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe	80
PID 1016 wrote to memory of 3588	1016	3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe	80
PID 3588 wrote to memory of 392	3588	RegSvcs.exe	81
PID 3588 wrote to memory of 392	3588	RegSvcs.exe	81
PID 3588 wrote to memory of 392	3588	RegSvcs.exe	81
PID 3588 wrote to memory of 392	3588	RegSvcs.exe	81
PID 3588 wrote to memory of 392	3588	RegSvcs.exe	81
PID 3588 wrote to memory of 392	3588	RegSvcs.exe	81
PID 3588 wrote to memory of 392	3588	RegSvcs.exe	81
PID 3588 wrote to memory of 392	3588	RegSvcs.exe	81
PID 3588 wrote to memory of 3312	3588	RegSvcs.exe	85
PID 3588 wrote to memory of 3312	3588	RegSvcs.exe	85
PID 3588 wrote to memory of 3312	3588	RegSvcs.exe	85
PID 3588 wrote to memory of 3312	3588	RegSvcs.exe	85
PID 3588 wrote to memory of 3312	3588	RegSvcs.exe	85
PID 3588 wrote to memory of 3312	3588	RegSvcs.exe	85
PID 3588 wrote to memory of 3312	3588	RegSvcs.exe	85
PID 3588 wrote to memory of 3312	3588	RegSvcs.exe	85

C:\Users\Admin\AppData\Local\Temp\3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe
"C:\Users\Admin\AppData\Local\Temp\3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\Ew1YI0ExHn.ini"
    3⤵
    PID:392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 80
      4⤵
      Program crash
      PID:4580
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\FTDfWgkqrH.ini"
    3⤵
    PID:3312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 80
      4⤵
      Program crash
      PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 392 -ip 392
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3312 -ip 3312
1⤵
PID:4856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-132-0x0000000075300000-0x00000000758B1000-memory.dmp

Filesize
5.7MB

Download
memory/1016-139-0x0000000075300000-0x00000000758B1000-memory.dmp

Filesize
5.7MB

Download
memory/3588-134-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3588-136-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3588-142-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3588-145-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download