isrstealer | 018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8

Analysis

max time kernel
48s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe
Size

1.3MB
MD5

4753fe490e06759ed4af57c52959cde9
SHA1

7fae7af36fc9fb30385cf462f397ebe738610eb0
SHA256

018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8
SHA512

70131ad6d76aa6d9a614731d8e9bf983d7819d97b40aafe6d8c5e93e608e2ba882cbd3b98574d7c73f7344b941682b225a36e29e61bb49f72304c431ca590f73
SSDEEP

24576:KaHMv6Corjqny/Q5U0JW0fRqrSPy/2wP1aoUJ4:K1vqjd/Q5U0EiRI/2wdaA

Score

10^/10

isrstealer stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/112-58-0x0000000000400000-0x0000000000445000-memory.dmp	family_isrstealer
behavioral1/memory/112-60-0x0000000000000000-mapping.dmp	family_isrstealer
behavioral1/memory/112-61-0x0000000000400000-0x0000000000445000-memory.dmp	family_isrstealer
behavioral1/memory/112-62-0x0000000000400000-0x0000000000445000-memory.dmp	family_isrstealer

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
660	112	WerFault.exe	28

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe
1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe
1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe
1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe
1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe
1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe
1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 112	1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe	28
PID 1888 wrote to memory of 112	1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe	28
PID 1888 wrote to memory of 112	1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe	28
PID 1888 wrote to memory of 112	1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe	28
PID 1888 wrote to memory of 112	1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe	28
PID 1888 wrote to memory of 112	1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe	28
PID 1888 wrote to memory of 112	1888	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe	28
PID 112 wrote to memory of 660	112	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe	29
PID 112 wrote to memory of 660	112	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe	29
PID 112 wrote to memory of 660	112	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe	29
PID 112 wrote to memory of 660	112	018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe	29

C:\Users\Admin\AppData\Local\Temp\018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe
"C:\Users\Admin\AppData\Local\Temp\018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe
  "C:\Users\Admin\AppData\Local\Temp\018111e36651a7a4590818f65190a2f74278c9ac5a964506009c115bebc76ef8.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 144
    3⤵
    - Program crash
    PID:660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-55-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/112-56-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/112-58-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/112-61-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/112-62-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1888-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download