isrstealer | 9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb

General

Target

9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe
Size

247KB
MD5

77b0d01c5b228841bac4672a5834cc61
SHA1

aaf8ae8902469f7a987cb505b82d9ad465262c2e
SHA256

9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb
SHA512

562c8862d68bc8162027abe67e216c6e5ac0295cfc1d351cb6b4746fe32ceb4275160e7b67aee0f41423cd822efb405d3f7e6aea6c3be11a5a1913b52591b4b3
SSDEEP

3072:GjnS2QXDU+Jz6pL26HdX/ZMRfEZ+vzsjjV92sley4LTZT2DcZqy8BmV5RTvSUIEl:7TTA26Hd+s9leDTV2D9k5RT6Xq6a

Score

10^/10

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/892-60-0x0000000000400000-0x0000000000432000-memory.dmp	family_isrstealer
behavioral1/memory/892-62-0x0000000000400000-0x0000000000432000-memory.dmp	family_isrstealer
behavioral1/memory/892-63-0x0000000000401130-mapping.dmp	family_isrstealer
behavioral1/memory/892-74-0x0000000000400000-0x0000000000432000-memory.dmp	family_isrstealer

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1448-68-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1448-72-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1448-73-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1448-75-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1448-76-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 892	1636	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	27
PID 892 set thread context of 1448	892	cvtres.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
892	cvtres.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 892	1636	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	27
PID 1636 wrote to memory of 892	1636	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	27
PID 1636 wrote to memory of 892	1636	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	27
PID 1636 wrote to memory of 892	1636	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	27
PID 1636 wrote to memory of 892	1636	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	27
PID 1636 wrote to memory of 892	1636	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	27
PID 1636 wrote to memory of 892	1636	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	27
PID 1636 wrote to memory of 892	1636	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	27
PID 892 wrote to memory of 1448	892	cvtres.exe	28
PID 892 wrote to memory of 1448	892	cvtres.exe	28
PID 892 wrote to memory of 1448	892	cvtres.exe	28
PID 892 wrote to memory of 1448	892	cvtres.exe	28
PID 892 wrote to memory of 1448	892	cvtres.exe	28
PID 892 wrote to memory of 1448	892	cvtres.exe	28
PID 892 wrote to memory of 1448	892	cvtres.exe	28
PID 892 wrote to memory of 1448	892	cvtres.exe	28
PID 892 wrote to memory of 1448	892	cvtres.exe	28

memory/892-62-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/892-74-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/892-57-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/892-58-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/892-60-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1448-73-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1448-68-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1448-72-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1448-75-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1448-76-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1636-56-0x0000000074E30000-0x00000000753DB000-memory.dmp

Filesize
5.7MB

Download
memory/1636-65-0x0000000074E30000-0x00000000753DB000-memory.dmp

Filesize
5.7MB

Download
memory/1636-54-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1636-55-0x0000000074E30000-0x00000000753DB000-memory.dmp

Filesize
5.7MB

Download