isrstealer | c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100

General

Target

c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe
Size

288KB
MD5

6b8503490d3a79ae7f01af43a901836e
SHA1

48081eeedc72f114c4abe37c1635fff9354b760f
SHA256

c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100
SHA512

26895f3ff07750f02926adaf6e3bc8fc639af065d04f84dd75ee64a696eaa598145c3796727cc94acad7d941e582480167121231c3c9df16d5b961eac517a53a
SSDEEP

6144:+B7VgTrrf922XH2kWMVPrAnPiEjyh8lfAaphZJeeee:+kngnPCCdp/Jeeee

Score

10^/10

isrstealer bootkit persistence spyware stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4544-141-0x0000000000000000-mapping.dmp	family_isrstealer
behavioral2/memory/4544-142-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/4544-146-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/4544-148-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/4544-150-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1296 set thread context of 4944	1296	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	85
PID 4944 set thread context of 4544	4944	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4544	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe
4544	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe
4544	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe
4544	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe
4544	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe
4544	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe
4544	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe
4544	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1296	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe
4944	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe
4544	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 4944	1296	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	85
PID 1296 wrote to memory of 4944	1296	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	85
PID 1296 wrote to memory of 4944	1296	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	85
PID 1296 wrote to memory of 4944	1296	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	85
PID 1296 wrote to memory of 4944	1296	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	85
PID 1296 wrote to memory of 4944	1296	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	85
PID 1296 wrote to memory of 4944	1296	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	85
PID 1296 wrote to memory of 4944	1296	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	85
PID 4944 wrote to memory of 4544	4944	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	86
PID 4944 wrote to memory of 4544	4944	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	86
PID 4944 wrote to memory of 4544	4944	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	86
PID 4944 wrote to memory of 4544	4944	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	86
PID 4944 wrote to memory of 4544	4944	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	86
PID 4944 wrote to memory of 4544	4944	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	86
PID 4944 wrote to memory of 4544	4944	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	86
PID 4944 wrote to memory of 4544	4944	c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe	86

C:\Users\Admin\AppData\Local\Temp\c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe
"C:\Users\Admin\AppData\Local\Temp\c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Users\Admin\AppData\Local\Temp\c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe
  "C:\Users\Admin\AppData\Local\Temp\c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Users\Admin\AppData\Local\Temp\c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe
    "C:\Users\Admin\AppData\Local\Temp\c6da0915764ef075df7e86fb8d990d62e99d114a6d045c2c872c21c6e3fca100.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1296-132-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4544-142-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4544-146-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4544-148-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4544-150-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4944-136-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4944-140-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4944-147-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4944-149-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing