isrstealer | c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec

General

Target

c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
Size

288KB
MD5

084870aad203d8fdeefc14da8d02069e
SHA1

caa1c1bb4a8af41ebe4ed417d0a0fd8f3351ae5e
SHA256

c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec
SHA512

5b4260e60c3543bb9d8ed35af1d7f32dda6be6076b8efe3564206a4b91365565d30ba37c639ff28378da37ac430450fc6c43922860455ceb4146ab2a66070ff8
SSDEEP

3072:O12i3kbpR6kaa6Y/gVq8X9R30Z/flKRFd/RRo74xzQWugHHkrtcFox89XHL4d/p6:O173epMkyCR1ClWEUbgnk1m1Hcwtb9S

Score

10^/10

isrstealer bootkit persistence spyware stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 5 IoCs

resource	yara_rule
behavioral1/memory/1484-70-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1484-71-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1484-72-0x00000000004011F0-mapping.dmp	family_isrstealer
behavioral1/memory/1484-78-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1484-79-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 944 set thread context of 268	944	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	28
PID 268 set thread context of 1484	268	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1484	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
1484	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
1484	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
1484	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
944	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
268	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
1484	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 268	944	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	28
PID 944 wrote to memory of 268	944	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	28
PID 944 wrote to memory of 268	944	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	28
PID 944 wrote to memory of 268	944	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	28
PID 944 wrote to memory of 268	944	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	28
PID 944 wrote to memory of 268	944	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	28
PID 944 wrote to memory of 268	944	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	28
PID 944 wrote to memory of 268	944	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	28
PID 944 wrote to memory of 268	944	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	28
PID 268 wrote to memory of 1484	268	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	29
PID 268 wrote to memory of 1484	268	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	29
PID 268 wrote to memory of 1484	268	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	29
PID 268 wrote to memory of 1484	268	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	29
PID 268 wrote to memory of 1484	268	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	29
PID 268 wrote to memory of 1484	268	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	29
PID 268 wrote to memory of 1484	268	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	29
PID 268 wrote to memory of 1484	268	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	29

C:\Users\Admin\AppData\Local\Temp\c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
"C:\Users\Admin\AppData\Local\Temp\c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Local\Temp\c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
  "C:\Users\Admin\AppData\Local\Temp\c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Users\Admin\AppData\Local\Temp\c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
    "C:\Users\Admin\AppData\Local\Temp\c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe"
    3⤵
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-56-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/268-57-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/268-59-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/268-62-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/268-74-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1484-68-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1484-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1484-71-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1484-67-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1484-77-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1484-78-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1484-79-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing