isrstealer | fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9

General

Target

fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Size

808KB
MD5

d501362eabe646ccd66b5c6e771bbd35
SHA1

bde19480d2fd319553dbf1dd6097028e4b65d2ad
SHA256

fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9
SHA512

5ec5b0d1bf528dc1e13022fb03e6f6a0b4058f985c574fc27db98a2e9527a786e993fef8fe5074d12666c352f59a2fa7f16edb6fdf4f7f51d056bd39c9cca993
SSDEEP

12288:jzRzCUuOz3kQc1G6jwX8OR72oWbU4jWy8ExZzjzlVNxpVhyAxFStKrSAdFLc:jtCUuOgQc13jvOFHWbU46mxF3X3uP

Score

10^/10

isrstealer spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/4272-150-0x0000000000400000-0x0000000000434000-memory.dmp	family_isrstealer
behavioral2/memory/4272-149-0x0000000000000000-mapping.dmp	family_isrstealer
behavioral2/memory/4272-166-0x0000000000400000-0x0000000000434000-memory.dmp	family_isrstealer
behavioral2/memory/4272-168-0x0000000000400000-0x0000000000434000-memory.dmp	family_isrstealer

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1548-158-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1548-161-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1548-164-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1548-165-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4884 set thread context of 4272	4884	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	82
PID 4272 set thread context of 1548	4272	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	83

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\InprocServer32\ThreadingModel = "both"	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\ProgID\ = "PLA.LegacyDataCollectorSetCollection.1"	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\Version	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\Version\ = "1.0"	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\AppID = "{03837503-098b-11d8-9414-505054503030}"	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\InprocServer32\ = "%SystemRoot%\\SysWow64\\pla.dll"	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\LocalServer32\ = "%SystemRoot%\\SysWow64\\plasrv.exe"	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\TypeLib	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\VersionIndependentProgID	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\VersionIndependentProgID\ = "PLA.LegacyDataCollectorSetCollection"	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\ = "LegacyDataCollectorSetCollection"	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\ProgID	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\InprocServer32	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\LocalServer32	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\TypeLib\ = "{03837500-098B-11D8-9414-505054503030}"	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4884	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
Token: SeIncBasePriorityPrivilege	4884	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4884	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
4272	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4884	4944	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	81
PID 4944 wrote to memory of 4884	4944	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	81
PID 4944 wrote to memory of 4884	4944	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	81
PID 4884 wrote to memory of 4272	4884	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	82
PID 4884 wrote to memory of 4272	4884	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	82
PID 4884 wrote to memory of 4272	4884	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	82
PID 4884 wrote to memory of 4272	4884	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	82
PID 4884 wrote to memory of 4272	4884	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	82
PID 4884 wrote to memory of 4272	4884	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	82
PID 4884 wrote to memory of 4272	4884	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	82
PID 4884 wrote to memory of 4272	4884	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	82
PID 4272 wrote to memory of 1548	4272	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	83
PID 4272 wrote to memory of 1548	4272	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	83
PID 4272 wrote to memory of 1548	4272	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	83
PID 4272 wrote to memory of 1548	4272	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	83
PID 4272 wrote to memory of 1548	4272	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	83
PID 4272 wrote to memory of 1548	4272	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	83
PID 4272 wrote to memory of 1548	4272	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	83
PID 4272 wrote to memory of 1548	4272	fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe	83

C:\Users\Admin\AppData\Local\Temp\fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
"C:\Users\Admin\AppData\Local\Temp\fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\Temp\fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
  "C:\Users\Admin\AppData\Local\Temp\fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe"
  2⤵
  - Checks BIOS information in registry
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Users\Admin\AppData\Local\Temp\fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
    C:\Users\Admin\AppData\Local\Temp\fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\fbc3e502aca3c03dddab287cc03afa103ecf644ae8690c5a21f9aa885803f5b9.exe
      /scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"
      4⤵
      PID:1548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
memory/1548-165-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1548-164-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1548-161-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1548-158-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4272-166-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4272-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4272-150-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4884-141-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/4884-154-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/4884-145-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/4884-143-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/4884-142-0x0000000000501000-0x000000000052F000-memory.dmp

Filesize
184KB

Download
memory/4884-144-0x0000000000401000-0x000000000040D000-memory.dmp

Filesize
48KB

Download
memory/4884-136-0x0000000000500000-0x0000000000548000-memory.dmp

Filesize
288KB

Download
memory/4884-146-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/4944-152-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/4944-132-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download

Analysis

Sharing