isrstealer | 848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8

General

Target

848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe
Size

355KB
MD5

3eb943bc2347fbe66d4ed99cf739b9ed
SHA1

78eed9380d03c9762f9e7cf45413cbf6564e196c
SHA256

848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8
SHA512

963d820388a7c39f1ecaa43372cd6ac6ae8d6453aa22f989fcf0e61a34d6ec65afa1118634523da59e95c121c46aaf01f3cd7d2b21fe2b6d0943e6e85b1d6b9e
SSDEEP

6144:TR9UfUfTajZcHQl+XQGEPVwCOa4sIj+IPqxo0zUgQ6z9rAlpZ+OldtmkcL5:X/2jaQgQGEPVzCn0zUgT9riod

Score

10^/10

isrstealer spyware stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/1876-141-0x0000000000000000-mapping.dmp	family_isrstealer
behavioral2/memory/1876-142-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/1876-147-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/1876-148-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Executes dropped EXE 3 IoCs

pid	Process
3404	Iobit Advanced systemcare keygen + patch.exe
4940	icecream.exe
1876	icecream.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4940 set thread context of 1876	4940	icecream.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1876	icecream.exe
1876	icecream.exe
1876	icecream.exe
1876	icecream.exe
1876	icecream.exe
1876	icecream.exe
1876	icecream.exe
1876	icecream.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4940	icecream.exe
1876	icecream.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 3404	1668	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	84
PID 1668 wrote to memory of 3404	1668	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	84
PID 1668 wrote to memory of 3404	1668	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	84
PID 1668 wrote to memory of 4940	1668	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	85
PID 1668 wrote to memory of 4940	1668	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	85
PID 1668 wrote to memory of 4940	1668	848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe	85
PID 4940 wrote to memory of 1876	4940	icecream.exe	87
PID 4940 wrote to memory of 1876	4940	icecream.exe	87
PID 4940 wrote to memory of 1876	4940	icecream.exe	87
PID 4940 wrote to memory of 1876	4940	icecream.exe	87
PID 4940 wrote to memory of 1876	4940	icecream.exe	87
PID 4940 wrote to memory of 1876	4940	icecream.exe	87
PID 4940 wrote to memory of 1876	4940	icecream.exe	87
PID 4940 wrote to memory of 1876	4940	icecream.exe	87

C:\Users\Admin\AppData\Local\Temp\848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe
"C:\Users\Admin\AppData\Local\Temp\848b6ba49d84afdf4704dfb5bbe9d485f765c93cd7130562e8722a5e40e657f8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\Iobit Advanced systemcare keygen + patch.exe
  "C:\Users\Admin\AppData\Local\Temp\Iobit Advanced systemcare keygen + patch.exe"
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Users\Admin\AppData\Local\Temp\icecream.exe
  "C:\Users\Admin\AppData\Local\Temp\icecream.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Users\Admin\AppData\Local\Temp\icecream.exe
    C:\Users\Admin\AppData\Local\Temp\icecream.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Iobit Advanced systemcare keygen + patch.exe

Filesize
264KB

MD5
3b83845371d92aa4121b9f925d0f6cfb

SHA1
7776f4b515534f3cf7bbc02dc22ff0d5e633e7bf

SHA256
6e32688af044fae3c59d2c97054c00cf9c4cc1bcbf1e147347f66b6845894677

SHA512
f079adf6d2b140038d9d4213848f3bdf0ddc8240b556df7af030da8140a4c253c428adf3829598268b0796f619ae903560657bbca0d374945449891827b63ca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iobit Advanced systemcare keygen + patch.exe

Filesize
264KB

MD5
3b83845371d92aa4121b9f925d0f6cfb

SHA1
7776f4b515534f3cf7bbc02dc22ff0d5e633e7bf

SHA256
6e32688af044fae3c59d2c97054c00cf9c4cc1bcbf1e147347f66b6845894677

SHA512
f079adf6d2b140038d9d4213848f3bdf0ddc8240b556df7af030da8140a4c253c428adf3829598268b0796f619ae903560657bbca0d374945449891827b63ca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
C:\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
C:\Users\Admin\AppData\Local\Temp\icecream.exe

Filesize
180KB

MD5
34ec4c8825a54e56d6b2212f979cadea

SHA1
61797ebb6746801e45fd6d0e01146c02efb13026

SHA256
fc77f3b9a05d48b46120b84c8b3eca9681cb26f33799432a58aa5c7aaa0203f3

SHA512
e6a490a635da740956be185ab3621930f0e34fe2fab3578bf687c603aa12ec73984b96a8f314fafc2f89bce8500b0618ea15493b871aab9a83779ce7145d6217

Download Submit
memory/1876-142-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1876-147-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1876-148-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3404-139-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download

Analysis

Sharing