isrstealer | fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9

General

Target

fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Size

808KB
MD5

d501362eabe646ccd66b5c6e771bbd35
SHA1

bde19480d2fd319553dbf1dd6097028e4b65d2ad
SHA256

fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9
SHA512

5ec5b0d1bf528dc1e13022fb03e6f6a0b4058f985c574fc27db98a2e9527a786e993fef8fe5074d12666c352f59a2fa7f16edb6fdf4f7f51d056bd39c9cca993
SSDEEP

12288:jzRzCUuOz3kQc1G6jwX8OR72oWbU4jWy8ExZzjzlVNxpVhyAxFStKrSAdFLc:jtCUuOgQc13jvOFHWbU46mxF3X3uP

Score

10^/10

isrstealer spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/1232-71-0x0000000000400000-0x0000000000434000-memory.dmp	family_isrstealer
behavioral1/memory/1232-72-0x0000000000401130-mapping.dmp	family_isrstealer
behavioral1/memory/1232-84-0x0000000000400000-0x0000000000434000-memory.dmp	family_isrstealer

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1500-78-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1500-82-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1500-83-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1500-86-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1500-87-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 1232	1980	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	27
PID 1232 set thread context of 1500	1232	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	28

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\ = "Outlook Form Factory"	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\InprocHandler32	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\InprocHandler32\ = "ole32.dll"	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\LocalServer32	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\LocalServer32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\OUTLOOK.EXE"	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1980	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Token: SeIncBasePriorityPrivilege	1980	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1980	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
1232	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1980	1992	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	26
PID 1992 wrote to memory of 1980	1992	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	26
PID 1992 wrote to memory of 1980	1992	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	26
PID 1992 wrote to memory of 1980	1992	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	26
PID 1980 wrote to memory of 1232	1980	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	27
PID 1980 wrote to memory of 1232	1980	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	27
PID 1980 wrote to memory of 1232	1980	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	27
PID 1980 wrote to memory of 1232	1980	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	27
PID 1980 wrote to memory of 1232	1980	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	27
PID 1980 wrote to memory of 1232	1980	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	27
PID 1980 wrote to memory of 1232	1980	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	27
PID 1980 wrote to memory of 1232	1980	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	27
PID 1980 wrote to memory of 1232	1980	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	27
PID 1232 wrote to memory of 1500	1232	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	28
PID 1232 wrote to memory of 1500	1232	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	28
PID 1232 wrote to memory of 1500	1232	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	28
PID 1232 wrote to memory of 1500	1232	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	28
PID 1232 wrote to memory of 1500	1232	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	28
PID 1232 wrote to memory of 1500	1232	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	28
PID 1232 wrote to memory of 1500	1232	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	28
PID 1232 wrote to memory of 1500	1232	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	28
PID 1232 wrote to memory of 1500	1232	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	28

C:\Users\Admin\AppData\Local\Temp\fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
"C:\Users\Admin\AppData\Local\Temp\fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
  "C:\Users\Admin\AppData\Local\Temp\fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe"
  2⤵
  - Checks BIOS information in registry
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
    C:\Users\Admin\AppData\Local\Temp\fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
      /scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"
      4⤵
      PID:1500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1232-88-0x0000000002580000-0x0000000002674000-memory.dmp

Filesize
976KB

Download
memory/1232-85-0x0000000002580000-0x0000000002674000-memory.dmp

Filesize
976KB

Download
memory/1232-84-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1500-83-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1500-78-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1500-87-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1500-86-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1500-82-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1980-76-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/1980-62-0x0000000000401000-0x000000000040D000-memory.dmp

Filesize
48KB

Download
memory/1980-64-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/1980-63-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/1980-70-0x00000000002C1000-0x00000000002EF000-memory.dmp

Filesize
184KB

Download
memory/1980-69-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/1980-61-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/1980-56-0x00000000002C0000-0x0000000000308000-memory.dmp

Filesize
288KB

Download
memory/1980-55-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1992-74-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/1992-68-0x0000000001E80000-0x0000000001F74000-memory.dmp

Filesize
976KB

Download
memory/1992-67-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download

Analysis

Sharing