isrstealer | 848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8

Analysis

max time kernel
130s
max time network
106s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe
Size

355KB
MD5

3eb943bc2347fbe66d4ed99cf739b9ed
SHA1

78eed9380d03c9762f9e7cf45413cbf6564e196c
SHA256

848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8
SHA512

963d820388a7c39f1ecaa43372cd6ac6ae8d6453aa22f989fcf0e61a34d6ec65afa1118634523da59e95c121c46aaf01f3cd7d2b21fe2b6d0943e6e85b1d6b9e
SSDEEP

6144:TR9UfUfTajZcHQl+XQGEPVwCOa4sIj+IPqxo0zUgQ6z9rAlpZ+OldtmkcL5:X/2jaQgQGEPVzCn0zUgT9riod

Score

10^/10

isrstealer spyware stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1296-80-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1296-81-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1296-82-0x00000000004011F0-mapping.dmp	family_isrstealer
behavioral1/memory/1296-91-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1296-92-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1296-93-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Executes dropped EXE 3 IoCs

pid	Process
968	Iobit Advanced systemcare keygen + patch.exe
936	icecream.exe
1296	icecream.exe

Loads dropped DLL 13 IoCs

pid	Process
1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe
968	Iobit Advanced systemcare keygen + patch.exe
968	Iobit Advanced systemcare keygen + patch.exe
968	Iobit Advanced systemcare keygen + patch.exe
1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe
1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe
936	icecream.exe
936	icecream.exe
936	icecream.exe
936	icecream.exe
1296	icecream.exe
1296	icecream.exe
1296	icecream.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 936 set thread context of 1296	936	icecream.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1296	icecream.exe
1296	icecream.exe
1296	icecream.exe
1296	icecream.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
936	icecream.exe
1296	icecream.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 968	1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	28
PID 1648 wrote to memory of 968	1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	28
PID 1648 wrote to memory of 968	1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	28
PID 1648 wrote to memory of 968	1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	28
PID 1648 wrote to memory of 968	1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	28
PID 1648 wrote to memory of 968	1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	28
PID 1648 wrote to memory of 968	1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	28
PID 1648 wrote to memory of 936	1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	29
PID 1648 wrote to memory of 936	1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	29
PID 1648 wrote to memory of 936	1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	29
PID 1648 wrote to memory of 936	1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	29
PID 1648 wrote to memory of 936	1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	29
PID 1648 wrote to memory of 936	1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	29
PID 1648 wrote to memory of 936	1648	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	29
PID 936 wrote to memory of 1296	936	icecream.exe	30
PID 936 wrote to memory of 1296	936	icecream.exe	30
PID 936 wrote to memory of 1296	936	icecream.exe	30
PID 936 wrote to memory of 1296	936	icecream.exe	30
PID 936 wrote to memory of 1296	936	icecream.exe	30
PID 936 wrote to memory of 1296	936	icecream.exe	30
PID 936 wrote to memory of 1296	936	icecream.exe	30
PID 936 wrote to memory of 1296	936	icecream.exe	30
PID 936 wrote to memory of 1296	936	icecream.exe	30
PID 936 wrote to memory of 1296	936	icecream.exe	30
PID 936 wrote to memory of 1296	936	icecream.exe	30

C:\Users\Admin\AppData\Local\Temp\848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe
"C:\Users\Admin\AppData\Local\Temp\848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Temp\Iobit Advanced systemcare keygen + patch.exe
  "C:\Users\Admin\AppData\Local\Temp\Iobit Advanced systemcare keygen + patch.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:968
- C:\Users\Admin\AppData\Local\Temp\icecream.exe
  "C:\Users\Admin\AppData\Local\Temp\icecream.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Users\Admin\AppData\Local\Temp\icecream.exe
    C:\Users\Admin\AppData\Local\Temp\icecream.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Iobit Advanced systemcare keygen + patch.exe

Filesize
264KB

MD5
3b83845371d92aa4121b9f925d0f6cfb

SHA1
7776f4b515534f3cf7bbc02dc22ff0d5e633e7bf

SHA256
6e32688af044fae3c59d2c97054c00cf9c4cc1bcbf1e147347f66b6845894677

SHA512
f079adf6d2b140038d9d4213848f3bdf0ddc8240b556df7af030da8140a4c253c428adf3829598268b0796f619ae903560657bbca0d374945449891827b63ca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iobit Advanced systemcare keygen + patch.exe

Filesize
264KB

MD5
3b83845371d92aa4121b9f925d0f6cfb

SHA1
7776f4b515534f3cf7bbc02dc22ff0d5e633e7bf

SHA256
6e32688af044fae3c59d2c97054c00cf9c4cc1bcbf1e147347f66b6845894677

SHA512
f079adf6d2b140038d9d4213848f3bdf0ddc8240b556df7af030da8140a4c253c428adf3829598268b0796f619ae903560657bbca0d374945449891827b63ca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
C:\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
C:\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
\Users\Admin\AppData\Local\Temp\Iobit Advanced systemcare keygen + patch.exe

Filesize
264KB

MD5
3b83845371d92aa4121b9f925d0f6cfb

SHA1
7776f4b515534f3cf7bbc02dc22ff0d5e633e7bf

SHA256
6e32688af044fae3c59d2c97054c00cf9c4cc1bcbf1e147347f66b6845894677

SHA512
f079adf6d2b140038d9d4213848f3bdf0ddc8240b556df7af030da8140a4c253c428adf3829598268b0796f619ae903560657bbca0d374945449891827b63ca4

Download Submit
\Users\Admin\AppData\Local\Temp\Iobit Advanced systemcare keygen + patch.exe

Filesize
264KB

MD5
3b83845371d92aa4121b9f925d0f6cfb

SHA1
7776f4b515534f3cf7bbc02dc22ff0d5e633e7bf

SHA256
6e32688af044fae3c59d2c97054c00cf9c4cc1bcbf1e147347f66b6845894677

SHA512
f079adf6d2b140038d9d4213848f3bdf0ddc8240b556df7af030da8140a4c253c428adf3829598268b0796f619ae903560657bbca0d374945449891827b63ca4

Download Submit
\Users\Admin\AppData\Local\Temp\Iobit Advanced systemcare keygen + patch.exe

Filesize
264KB

MD5
3b83845371d92aa4121b9f925d0f6cfb

SHA1
7776f4b515534f3cf7bbc02dc22ff0d5e633e7bf

SHA256
6e32688af044fae3c59d2c97054c00cf9c4cc1bcbf1e147347f66b6845894677

SHA512
f079adf6d2b140038d9d4213848f3bdf0ddc8240b556df7af030da8140a4c253c428adf3829598268b0796f619ae903560657bbca0d374945449891827b63ca4

Download Submit
\Users\Admin\AppData\Local\Temp\Iobit Advanced systemcare keygen + patch.exe

Filesize
264KB

MD5
3b83845371d92aa4121b9f925d0f6cfb

SHA1
7776f4b515534f3cf7bbc02dc22ff0d5e633e7bf

SHA256
6e32688af044fae3c59d2c97054c00cf9c4cc1bcbf1e147347f66b6845894677

SHA512
f079adf6d2b140038d9d4213848f3bdf0ddc8240b556df7af030da8140a4c253c428adf3829598268b0796f619ae903560657bbca0d374945449891827b63ca4

Download Submit
\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
memory/968-74-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/968-75-0x00000000009B0000-0x0000000000A9C000-memory.dmp

Filesize
944KB

Download
memory/968-94-0x00000000009B0000-0x0000000000A9C000-memory.dmp

Filesize
944KB

Download
memory/1296-78-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1296-80-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1296-81-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1296-77-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1296-91-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1296-92-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1296-93-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1648-54-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download