isrstealer | f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f

Analysis

max time kernel
147s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe
Size

20.6MB
MD5

c9d30935cb9350dbce1cbfc2ac92dbc5
SHA1

e66ccf6cb22f07c6e80645dd715631dc00293936
SHA256

f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f
SHA512

19d7858888c385b7f1d54fd1ab4cab92a5e07e452b929b6b4004518dec0f54c8f02ebc883992c80cd1e4c83da682f1a73c744e2630278a3947c5955585087847
SSDEEP

49152:GTLnvop5uWKmeI31s85sRK0zVaSU64qRKZCkFMjQeMuSIu1+AtcqzWS:2LdZmW8ux0h64BQkiQeMuSIu1+AOqzv

Score

10^/10

isrstealer persistence stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 5 IoCs

resource	yara_rule
behavioral1/memory/884-59-0x0000000000400000-0x0000000000435000-memory.dmp	family_isrstealer
behavioral1/memory/884-62-0x0000000000401180-mapping.dmp	family_isrstealer
behavioral1/memory/884-61-0x0000000000400000-0x0000000000435000-memory.dmp	family_isrstealer
behavioral1/memory/884-72-0x0000000000400000-0x0000000000435000-memory.dmp	family_isrstealer
behavioral1/memory/884-120-0x0000000000400000-0x0000000000435000-memory.dmp	family_isrstealer

Executes dropped EXE 1 IoCs

pid	Process
1336	Windows7Loader.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1312-66-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1312-70-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1312-71-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1312-73-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/files/0x0009000000012310-74.dat	upx
behavioral1/files/0x0009000000012310-76.dat	upx
behavioral1/files/0x0009000000012310-79.dat	upx
behavioral1/memory/1336-80-0x0000000000400000-0x0000000000623000-memory.dmp	upx
behavioral1/memory/1336-117-0x0000000000400000-0x0000000000623000-memory.dmp	upx
behavioral1/memory/1312-118-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Windows7Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Windows7Loader.exe

Loads dropped DLL 1 IoCs

pid	Process
2036	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Startup Key = "C:\\Users\\Admin\\AppData\\Local\\Temp\\autostart.exe"	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 884	2036	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe	28
PID 884 set thread context of 1312	884	vbc.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1336	Windows7Loader.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1336	Windows7Loader.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1336	Windows7Loader.exe
Token: SeIncBasePriorityPrivilege	1336	Windows7Loader.exe
Token: 33	1336	Windows7Loader.exe
Token: SeIncBasePriorityPrivilege	1336	Windows7Loader.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
884	vbc.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 884	2036	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe	28
PID 2036 wrote to memory of 884	2036	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe	28
PID 2036 wrote to memory of 884	2036	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe	28
PID 2036 wrote to memory of 884	2036	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe	28
PID 2036 wrote to memory of 884	2036	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe	28
PID 2036 wrote to memory of 884	2036	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe	28
PID 2036 wrote to memory of 884	2036	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe	28
PID 2036 wrote to memory of 884	2036	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe	28
PID 884 wrote to memory of 1312	884	vbc.exe	29
PID 884 wrote to memory of 1312	884	vbc.exe	29
PID 884 wrote to memory of 1312	884	vbc.exe	29
PID 884 wrote to memory of 1312	884	vbc.exe	29
PID 884 wrote to memory of 1312	884	vbc.exe	29
PID 884 wrote to memory of 1312	884	vbc.exe	29
PID 884 wrote to memory of 1312	884	vbc.exe	29
PID 884 wrote to memory of 1312	884	vbc.exe	29
PID 884 wrote to memory of 1312	884	vbc.exe	29
PID 2036 wrote to memory of 1336	2036	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe	30
PID 2036 wrote to memory of 1336	2036	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe	30
PID 2036 wrote to memory of 1336	2036	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe	30
PID 2036 wrote to memory of 1336	2036	f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe	30
PID 1336 wrote to memory of 1480	1336	Windows7Loader.exe	31
PID 1336 wrote to memory of 1480	1336	Windows7Loader.exe	31
PID 1336 wrote to memory of 1480	1336	Windows7Loader.exe	31
PID 1336 wrote to memory of 1480	1336	Windows7Loader.exe	31
PID 1480 wrote to memory of 1308	1480	cmd.exe	33
PID 1480 wrote to memory of 1308	1480	cmd.exe	33
PID 1480 wrote to memory of 1308	1480	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe
"C:\Users\Admin\AppData\Local\Temp\f91deae6f18054467eafaec13876afe848fd003fcc30b3c1b491c8e5a12d0a2f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\YZIEoojgMf.ini"
    3⤵
    PID:1312
- C:\Users\Admin\AppData\Local\Temp\Windows7Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows7Loader.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\system32\cmd.exe
    cmd.exe /A /C "C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -dli"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Windows\System32\cscript.exe
      C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -dli
      4⤵
      PID:1308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Windows7Loader.exe

Filesize
2.3MB

MD5
72ee2e9c9b43425522ecb853328d4d03

SHA1
938ecfd65abe1740fd4a3e3fba6adced5908f45a

SHA256
3a4637230861da31a5acecf797f96c5109b9103f3fda4a30cec86293da7aabdf

SHA512
594c46b1a8ff71c71e206b06861335ebdc12c26e13da3ee9e2edf3464d792436cb5e26f7f0cfab70935d544cf5ce3d2a3161126c8cc3a3440c107b4fd5c8d1ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows7Loader.exe

Filesize
2.3MB

MD5
72ee2e9c9b43425522ecb853328d4d03

SHA1
938ecfd65abe1740fd4a3e3fba6adced5908f45a

SHA256
3a4637230861da31a5acecf797f96c5109b9103f3fda4a30cec86293da7aabdf

SHA512
594c46b1a8ff71c71e206b06861335ebdc12c26e13da3ee9e2edf3464d792436cb5e26f7f0cfab70935d544cf5ce3d2a3161126c8cc3a3440c107b4fd5c8d1ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\YZIEoojgMf.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
\Users\Admin\AppData\Local\Temp\Windows7Loader.exe

Filesize
2.3MB

MD5
72ee2e9c9b43425522ecb853328d4d03

SHA1
938ecfd65abe1740fd4a3e3fba6adced5908f45a

SHA256
3a4637230861da31a5acecf797f96c5109b9103f3fda4a30cec86293da7aabdf

SHA512
594c46b1a8ff71c71e206b06861335ebdc12c26e13da3ee9e2edf3464d792436cb5e26f7f0cfab70935d544cf5ce3d2a3161126c8cc3a3440c107b4fd5c8d1ba

Download Submit
memory/884-120-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/884-56-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/884-57-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/884-59-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/884-61-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/884-72-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1312-73-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1312-71-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1312-70-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1312-118-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1312-66-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1336-81-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/1336-89-0x0000000000630000-0x0000000000641000-memory.dmp

Filesize
68KB

Download
memory/1336-97-0x0000000000650000-0x0000000000660000-memory.dmp

Filesize
64KB

Download
memory/1336-105-0x0000000000660000-0x0000000000670000-memory.dmp

Filesize
64KB

Download
memory/1336-80-0x0000000000400000-0x0000000000623000-memory.dmp

Filesize
2.1MB

Download
memory/1336-116-0x00000000023E0000-0x00000000024D6000-memory.dmp

Filesize
984KB

Download
memory/1336-117-0x0000000000400000-0x0000000000623000-memory.dmp

Filesize
2.1MB

Download
memory/2036-78-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/2036-55-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download