isrstealer | 537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5

General

Target

537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe
Size

980KB
MD5

61ec9f33042ed7a5dbcf2aa174f3641e
SHA1

741ee7fd03da983bb934b8ee6c8c8c9f0d8cb0ff
SHA256

537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5
SHA512

f68a7c356465f6bad55b6854870a8af46c67cde4251780abe2025721d2478ebbfede3bd84280eccc27553f8231e6028dc0f53aa0e3165df50950c4be412868f6
SSDEEP

12288:h2Ux5zpQmdTO3rlj/NSQPNE7bKVUW0IKvCnR77QV/VVvuFZFQW0xY38:EUxlTglJSQp90IcCnRMwZFQ8

Score

10^/10

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/468-59-0x0000000000400000-0x000000000048D000-memory.dmp	family_isrstealer
behavioral1/memory/468-61-0x0000000000400000-0x000000000048D000-memory.dmp	family_isrstealer
behavioral1/memory/468-62-0x0000000000401130-mapping.dmp	family_isrstealer
behavioral1/memory/468-74-0x0000000000400000-0x000000000048D000-memory.dmp	family_isrstealer

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1776-66-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1776-71-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1776-72-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1776-73-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1776-75-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1164 set thread context of 468	1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe	28
PID 468 set thread context of 1776	468	cvtres.exe	29

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe
1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe
1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe
1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe
1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe
1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe
1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe
1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe
1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe
1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe
1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
468	cvtres.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 468	1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe	28
PID 1164 wrote to memory of 468	1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe	28
PID 1164 wrote to memory of 468	1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe	28
PID 1164 wrote to memory of 468	1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe	28
PID 1164 wrote to memory of 468	1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe	28
PID 1164 wrote to memory of 468	1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe	28
PID 1164 wrote to memory of 468	1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe	28
PID 1164 wrote to memory of 468	1164	537f1dcbcce67bfd21fb5fe053dfd49dc6cbbc1efc09874b29f2cc4263f87ba5.exe	28
PID 468 wrote to memory of 1776	468	cvtres.exe	29
PID 468 wrote to memory of 1776	468	cvtres.exe	29
PID 468 wrote to memory of 1776	468	cvtres.exe	29
PID 468 wrote to memory of 1776	468	cvtres.exe	29
PID 468 wrote to memory of 1776	468	cvtres.exe	29
PID 468 wrote to memory of 1776	468	cvtres.exe	29
PID 468 wrote to memory of 1776	468	cvtres.exe	29
PID 468 wrote to memory of 1776	468	cvtres.exe	29
PID 468 wrote to memory of 1776	468	cvtres.exe	29

memory/468-56-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/468-57-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/468-59-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/468-61-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/468-74-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1164-68-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/1164-55-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/1164-54-0x0000000075671000-0x0000000075673000-memory.dmp

Filesize
8KB

Download
memory/1776-71-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1776-72-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1776-66-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1776-73-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1776-75-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download