isrstealer | b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe
Size

1.3MB
MD5

b38588a602da8a39add4afefd91395ce
SHA1

b4e21251343717dba9b271aceaefcb2f5f2188da
SHA256

b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9
SHA512

621b00b447b29ae009eaedc3c3d268cf4e82770baa6f8347656b6f7dc2cca4b97bcbfa06f2c1873bc713b1a45a7ae8f12bb348673ac1dedd3d438c5cef16e960
SSDEEP

24576:KaHMv6Corjqny/Q543dhZkDe0Jq34cRLUFLNGMVyH2ah6:K1vqjd/Q583gRgIcNUFsMyHY

Score

10^/10

isrstealer stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/1328-58-0x0000000000400000-0x0000000000443000-memory.dmp	family_isrstealer
behavioral1/memory/1328-60-0x0000000000000000-mapping.dmp	family_isrstealer
behavioral1/memory/1328-61-0x0000000000400000-0x0000000000443000-memory.dmp	family_isrstealer
behavioral1/memory/1328-63-0x0000000000400000-0x0000000000443000-memory.dmp	family_isrstealer

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1812	1328	WerFault.exe	27

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1272	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe
1272	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe
1272	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1272	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe
1272	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe
1272	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1328	1272	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe	27
PID 1272 wrote to memory of 1328	1272	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe	27
PID 1272 wrote to memory of 1328	1272	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe	27
PID 1272 wrote to memory of 1328	1272	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe	27
PID 1272 wrote to memory of 1328	1272	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe	27
PID 1272 wrote to memory of 1328	1272	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe	27
PID 1272 wrote to memory of 1328	1272	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe	27
PID 1328 wrote to memory of 1812	1328	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe	28
PID 1328 wrote to memory of 1812	1328	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe	28
PID 1328 wrote to memory of 1812	1328	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe	28
PID 1328 wrote to memory of 1812	1328	b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe	28

C:\Users\Admin\AppData\Local\Temp\b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe
"C:\Users\Admin\AppData\Local\Temp\b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe
  "C:\Users\Admin\AppData\Local\Temp\b2d05e58073e088f181baa61fc942c16ef211489d3aaa264426694e0df8d59d9.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 144
    3⤵
    - Program crash
    PID:1812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1328-55-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1328-58-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1328-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1328-61-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1328-63-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download