isrstealer | c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec

General

Target

c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
Size

288KB
MD5

084870aad203d8fdeefc14da8d02069e
SHA1

caa1c1bb4a8af41ebe4ed417d0a0fd8f3351ae5e
SHA256

c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec
SHA512

5b4260e60c3543bb9d8ed35af1d7f32dda6be6076b8efe3564206a4b91365565d30ba37c639ff28378da37ac430450fc6c43922860455ceb4146ab2a66070ff8
SSDEEP

3072:O12i3kbpR6kaa6Y/gVq8X9R30Z/flKRFd/RRo74xzQWugHHkrtcFox89XHL4d/p6:O173epMkyCR1ClWEUbgnk1m1Hcwtb9S

Score

10^/10

isrstealer bootkit persistence spyware stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/2680-140-0x0000000000000000-mapping.dmp	family_isrstealer
behavioral2/memory/2680-141-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/2680-145-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/2680-148-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/2680-149-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2180 set thread context of 2636	2180	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	85
PID 2636 set thread context of 2680	2636	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2680	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
2680	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
2680	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
2680	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
2680	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
2680	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
2680	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
2680	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2180	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
2636	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
2680	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2636	2180	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	85
PID 2180 wrote to memory of 2636	2180	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	85
PID 2180 wrote to memory of 2636	2180	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	85
PID 2180 wrote to memory of 2636	2180	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	85
PID 2180 wrote to memory of 2636	2180	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	85
PID 2180 wrote to memory of 2636	2180	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	85
PID 2180 wrote to memory of 2636	2180	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	85
PID 2180 wrote to memory of 2636	2180	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	85
PID 2636 wrote to memory of 2680	2636	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	86
PID 2636 wrote to memory of 2680	2636	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	86
PID 2636 wrote to memory of 2680	2636	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	86
PID 2636 wrote to memory of 2680	2636	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	86
PID 2636 wrote to memory of 2680	2636	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	86
PID 2636 wrote to memory of 2680	2636	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	86
PID 2636 wrote to memory of 2680	2636	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	86
PID 2636 wrote to memory of 2680	2636	c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe	86

C:\Users\Admin\AppData\Local\Temp\c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
"C:\Users\Admin\AppData\Local\Temp\c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
  "C:\Users\Admin\AppData\Local\Temp\c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe
    "C:\Users\Admin\AppData\Local\Temp\c65b0d438a31537f2e3bc240ee52bd1c5037bf7c1faf755ea54e85a23b4b9bec.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2636-135-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2636-139-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2636-146-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2636-147-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2680-141-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2680-145-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2680-148-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2680-149-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing