isrstealer | f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2

General

Target

f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe
Size

476KB
MD5

6741dc5ddd491db2b326f0fcad0b4790
SHA1

4bd15a7d6b0f8245552b7b3dac53d83c6787758e
SHA256

f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2
SHA512

4ba04046ef6bb9d6a7da0f9888dc795fc40b7ae8ddfbd1a8ae9e6dba8b3b4f5b7257484734ac72db87c18a4c309aa292fe90ff832ef95f959b6b263b19de1d85
SSDEEP

12288:n9eKNv21hW2RuTX0AahjA0OBmu96LFFt:IKNu1gVX01hjaBr6X

Score

10^/10

isrstealer persistence spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/1680-134-0x0000000000400000-0x0000000000438000-memory.dmp	family_isrstealer
behavioral2/memory/1680-151-0x0000000000400000-0x0000000000438000-memory.dmp	family_isrstealer
behavioral2/memory/1680-160-0x0000000000400000-0x0000000000438000-memory.dmp	family_isrstealer
behavioral2/memory/1680-161-0x0000000000400000-0x0000000000438000-memory.dmp	family_isrstealer

Executes dropped EXE 3 IoCs

pid	Process
1680	Service.exe
3208	Service.exe
4600	Sharecash Survey Helper.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3208-141-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3208-144-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3208-145-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3208-146-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Start-Up Name = "C:\\Users\\Admin\\AppData\\Roaming\\FacebookVideoCall.exe"	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2092 set thread context of 1680	2092	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	82
PID 1680 set thread context of 3208	1680	Service.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1680	Service.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1680	2092	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	82
PID 2092 wrote to memory of 1680	2092	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	82
PID 2092 wrote to memory of 1680	2092	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	82
PID 2092 wrote to memory of 1680	2092	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	82
PID 2092 wrote to memory of 1680	2092	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	82
PID 2092 wrote to memory of 1680	2092	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	82
PID 2092 wrote to memory of 1680	2092	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	82
PID 2092 wrote to memory of 1680	2092	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	82
PID 1680 wrote to memory of 3208	1680	Service.exe	83
PID 1680 wrote to memory of 3208	1680	Service.exe	83
PID 1680 wrote to memory of 3208	1680	Service.exe	83
PID 1680 wrote to memory of 3208	1680	Service.exe	83
PID 1680 wrote to memory of 3208	1680	Service.exe	83
PID 1680 wrote to memory of 3208	1680	Service.exe	83
PID 1680 wrote to memory of 3208	1680	Service.exe	83
PID 1680 wrote to memory of 3208	1680	Service.exe	83
PID 2092 wrote to memory of 4600	2092	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	84
PID 2092 wrote to memory of 4600	2092	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	84
PID 2092 wrote to memory of 4600	2092	f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe	84

C:\Users\Admin\AppData\Local\Temp\f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe
"C:\Users\Admin\AppData\Local\Temp\f8db5d2cad6f10867133309260241c56f5fd5339b1b44b99202d595d489466e2.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\plugtmp\Service.exe
  C:\Users\Admin\AppData\Local\Temp\\plugtmp\Service.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Users\Admin\AppData\Local\Temp\plugtmp\Service.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\E0dIOmj1Mb.ini"
    3⤵
    - Executes dropped EXE
    PID:3208
- C:\Users\Admin\AppData\Local\Temp\Sharecash Survey Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\Sharecash Survey Helper.exe"
  2⤵
  - Executes dropped EXE
  PID:4600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E0dIOmj1Mb.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sharecash Survey Helper.exe

Filesize
74KB

MD5
d86b1a667f4c98490342c03e12dbe662

SHA1
ccdf3f72e085a5eaccc9ffdb0655ef0ef2bb55ca

SHA256
4f4156b934e58d209e63ec72d9c5e83f511a917b6be79c6925e34087d83626cf

SHA512
b261bb44f3a15d4bc9a9949ea373893a3d368f92988b31025a9db44c336b4df4ff140a57ab4cedab0b32ee19a4e693a6d91816049bfdda5643b7119acbed6388

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sharecash Survey Helper.exe

Filesize
74KB

MD5
d86b1a667f4c98490342c03e12dbe662

SHA1
ccdf3f72e085a5eaccc9ffdb0655ef0ef2bb55ca

SHA256
4f4156b934e58d209e63ec72d9c5e83f511a917b6be79c6925e34087d83626cf

SHA512
b261bb44f3a15d4bc9a9949ea373893a3d368f92988b31025a9db44c336b4df4ff140a57ab4cedab0b32ee19a4e693a6d91816049bfdda5643b7119acbed6388

Download Submit
C:\Users\Admin\AppData\Local\Temp\plugtmp\Service.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\plugtmp\Service.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\plugtmp\Service.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/1680-151-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1680-134-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1680-161-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1680-160-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2092-132-0x0000000074F70000-0x0000000075521000-memory.dmp

Filesize
5.7MB

Download
memory/2092-159-0x0000000074F70000-0x0000000075521000-memory.dmp

Filesize
5.7MB

Download
memory/3208-141-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3208-146-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3208-145-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3208-144-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4600-152-0x0000000000460000-0x000000000047A000-memory.dmp

Filesize
104KB

Download
memory/4600-153-0x0000000005830000-0x00000000058CC000-memory.dmp

Filesize
624KB

Download
memory/4600-154-0x0000000005E80000-0x0000000006424000-memory.dmp

Filesize
5.6MB

Download
memory/4600-155-0x00000000058D0000-0x0000000005962000-memory.dmp

Filesize
584KB

Download
memory/4600-156-0x0000000005790000-0x000000000579A000-memory.dmp

Filesize
40KB

Download
memory/4600-157-0x0000000005A60000-0x0000000005AB6000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing