isrstealer | 9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb

Analysis

max time kernel
106s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 08:47

Target

9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe
Size

247KB
MD5

77b0d01c5b228841bac4672a5834cc61
SHA1

aaf8ae8902469f7a987cb505b82d9ad465262c2e
SHA256

9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb
SHA512

562c8862d68bc8162027abe67e216c6e5ac0295cfc1d351cb6b4746fe32ceb4275160e7b67aee0f41423cd822efb405d3f7e6aea6c3be11a5a1913b52591b4b3
SSDEEP

3072:GjnS2QXDU+Jz6pL26HdX/ZMRfEZ+vzsjjV92sley4LTZT2DcZqy8BmV5RTvSUIEl:7TTA26Hd+s9leDTV2D9k5RT6Xq6a

Score

10^/10

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 3 IoCs

resource	yara_rule
behavioral2/memory/3980-134-0x0000000000400000-0x0000000000432000-memory.dmp	family_isrstealer
behavioral2/memory/3980-145-0x0000000000400000-0x0000000000432000-memory.dmp	family_isrstealer
behavioral2/memory/3980-147-0x0000000000400000-0x0000000000432000-memory.dmp	family_isrstealer

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/924-140-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/924-142-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/924-143-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/924-144-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1836 set thread context of 3980	1836	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	83
PID 3980 set thread context of 924	3980	cvtres.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3980	cvtres.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 3980	1836	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	83
PID 1836 wrote to memory of 3980	1836	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	83
PID 1836 wrote to memory of 3980	1836	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	83
PID 1836 wrote to memory of 3980	1836	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	83
PID 1836 wrote to memory of 3980	1836	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	83
PID 1836 wrote to memory of 3980	1836	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	83
PID 1836 wrote to memory of 3980	1836	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	83
PID 1836 wrote to memory of 3980	1836	9a94961fa38c917cd1ad01c5ebe8197b3f39758e4f9894368c0ef8d9f0ceebbb.exe	83
PID 3980 wrote to memory of 924	3980	cvtres.exe	84
PID 3980 wrote to memory of 924	3980	cvtres.exe	84
PID 3980 wrote to memory of 924	3980	cvtres.exe	84
PID 3980 wrote to memory of 924	3980	cvtres.exe	84
PID 3980 wrote to memory of 924	3980	cvtres.exe	84
PID 3980 wrote to memory of 924	3980	cvtres.exe	84
PID 3980 wrote to memory of 924	3980	cvtres.exe	84
PID 3980 wrote to memory of 924	3980	cvtres.exe	84

C:\Users\Admin\AppData\Local\Temp\tmp.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
memory/924-140-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/924-142-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/924-143-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/924-144-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1836-132-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/1836-138-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/3980-134-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3980-145-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3980-147-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download