isrstealer | f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2

Analysis

max time kernel
57s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe
Size

476KB
MD5

6741dc5ddd491db2b326f0fcad0b4790
SHA1

4bd15a7d6b0f8245552b7b3dac53d83c6787758e
SHA256

f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2
SHA512

4ba04046ef6bb9d6a7da0f9888dc795fc40b7ae8ddfbd1a8ae9e6dba8b3b4f5b7257484734ac72db87c18a4c309aa292fe90ff832ef95f959b6b263b19de1d85
SSDEEP

12288:n9eKNv21hW2RuTX0AahjA0OBmu96LFFt:IKNu1gVX01hjaBr6X

Score

10^/10

isrstealer persistence spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 5 IoCs

resource	yara_rule
behavioral1/memory/1768-60-0x0000000000400000-0x0000000000438000-memory.dmp	family_isrstealer
behavioral1/memory/1768-63-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral1/memory/1768-62-0x0000000000400000-0x0000000000438000-memory.dmp	family_isrstealer
behavioral1/memory/1768-74-0x0000000000400000-0x0000000000438000-memory.dmp	family_isrstealer
behavioral1/memory/1768-91-0x0000000000400000-0x0000000000438000-memory.dmp	family_isrstealer

Executes dropped EXE 3 IoCs

pid	Process
1768	Service.exe
1744	Service.exe
1700	Sharecash Survey Helper.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1744-70-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1744-76-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1744-77-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1744-78-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1744-87-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1744-89-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe
1768	Service.exe
1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe
1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Start-Up Name = "C:\\Users\\Admin\\AppData\\Roaming\\FacebookVideoCall.exe"	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 1768	1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	27
PID 1768 set thread context of 1744	1768	Service.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1768	Service.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1768	1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	27
PID 1668 wrote to memory of 1768	1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	27
PID 1668 wrote to memory of 1768	1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	27
PID 1668 wrote to memory of 1768	1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	27
PID 1668 wrote to memory of 1768	1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	27
PID 1668 wrote to memory of 1768	1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	27
PID 1668 wrote to memory of 1768	1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	27
PID 1668 wrote to memory of 1768	1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	27
PID 1768 wrote to memory of 1744	1768	Service.exe	28
PID 1768 wrote to memory of 1744	1768	Service.exe	28
PID 1768 wrote to memory of 1744	1768	Service.exe	28
PID 1768 wrote to memory of 1744	1768	Service.exe	28
PID 1768 wrote to memory of 1744	1768	Service.exe	28
PID 1768 wrote to memory of 1744	1768	Service.exe	28
PID 1768 wrote to memory of 1744	1768	Service.exe	28
PID 1768 wrote to memory of 1744	1768	Service.exe	28
PID 1768 wrote to memory of 1744	1768	Service.exe	28
PID 1668 wrote to memory of 1700	1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	29
PID 1668 wrote to memory of 1700	1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	29
PID 1668 wrote to memory of 1700	1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	29
PID 1668 wrote to memory of 1700	1668	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	29

C:\Users\Admin\AppData\Local\Temp\f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe
"C:\Users\Admin\AppData\Local\Temp\f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\plugtmp\Service.exe
  C:\Users\Admin\AppData\Local\Temp\\plugtmp\Service.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Users\Admin\AppData\Local\Temp\plugtmp\Service.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\IcLSvzfWwf.ini"
    3⤵
    - Executes dropped EXE
    PID:1744
- C:\Users\Admin\AppData\Local\Temp\Sharecash Survey Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\Sharecash Survey Helper.exe"
  2⤵
  - Executes dropped EXE
  PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IcLSvzfWwf.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sharecash Survey Helper.exe

Filesize
74KB

MD5
d86b1a667f4c98490342c03e12dbe662

SHA1
ccdf3f72e085a5eaccc9ffdb0655ef0ef2bb55ca

SHA256
4f4156b934e58d209e63ec72d9c5e83f511a917b6be79c6925e34087d83626cf

SHA512
b261bb44f3a15d4bc9a9949ea373893a3d368f92988b31025a9db44c336b4df4ff140a57ab4cedab0b32ee19a4e693a6d91816049bfdda5643b7119acbed6388

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sharecash Survey Helper.exe

Filesize
74KB

MD5
d86b1a667f4c98490342c03e12dbe662

SHA1
ccdf3f72e085a5eaccc9ffdb0655ef0ef2bb55ca

SHA256
4f4156b934e58d209e63ec72d9c5e83f511a917b6be79c6925e34087d83626cf

SHA512
b261bb44f3a15d4bc9a9949ea373893a3d368f92988b31025a9db44c336b4df4ff140a57ab4cedab0b32ee19a4e693a6d91816049bfdda5643b7119acbed6388

Download Submit
C:\Users\Admin\AppData\Local\Temp\plugtmp\Service.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
C:\Users\Admin\AppData\Local\Temp\plugtmp\Service.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
C:\Users\Admin\AppData\Local\Temp\plugtmp\Service.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Users\Admin\AppData\Local\Temp\Sharecash Survey Helper.exe

Filesize
74KB

MD5
d86b1a667f4c98490342c03e12dbe662

SHA1
ccdf3f72e085a5eaccc9ffdb0655ef0ef2bb55ca

SHA256
4f4156b934e58d209e63ec72d9c5e83f511a917b6be79c6925e34087d83626cf

SHA512
b261bb44f3a15d4bc9a9949ea373893a3d368f92988b31025a9db44c336b4df4ff140a57ab4cedab0b32ee19a4e693a6d91816049bfdda5643b7119acbed6388

Download Submit
\Users\Admin\AppData\Local\Temp\Sharecash Survey Helper.exe

Filesize
74KB

MD5
d86b1a667f4c98490342c03e12dbe662

SHA1
ccdf3f72e085a5eaccc9ffdb0655ef0ef2bb55ca

SHA256
4f4156b934e58d209e63ec72d9c5e83f511a917b6be79c6925e34087d83626cf

SHA512
b261bb44f3a15d4bc9a9949ea373893a3d368f92988b31025a9db44c336b4df4ff140a57ab4cedab0b32ee19a4e693a6d91816049bfdda5643b7119acbed6388

Download Submit
\Users\Admin\AppData\Local\Temp\plugtmp\Service.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Users\Admin\AppData\Local\Temp\plugtmp\Service.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
memory/1668-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1668-92-0x0000000074740000-0x0000000074CEB000-memory.dmp

Filesize
5.7MB

Download
memory/1668-55-0x0000000074740000-0x0000000074CEB000-memory.dmp

Filesize
5.7MB

Download
memory/1700-88-0x0000000004D95000-0x0000000004DA6000-memory.dmp

Filesize
68KB

Download
memory/1700-85-0x0000000000D80000-0x0000000000D9A000-memory.dmp

Filesize
104KB

Download
memory/1744-89-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1744-78-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1744-77-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1744-76-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1744-87-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1744-70-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1768-74-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1768-62-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1768-60-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1768-58-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1768-91-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1768-57-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download