isrstealer | c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3

General

Target

c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe
Size

480KB
MD5

84730977d3c5921ce72f06569e0303d7
SHA1

0136a583df02745bdc1bbef21e6bf395a07a87ab
SHA256

c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3
SHA512

9f4b3eecb443f0b7b8cfc30dec73a2e04d639406e6c7c945382173d8bd11d12d28bb9e4888469ea0873e8f0c5b43ec0e9f3b6688afb8242dec451a353aa9e368
SSDEEP

12288:diJu+2t874tMkvsVSKgMG5PJVSiFCtDM:druNMMG5nSiFCtD

Score

10^/10

isrstealer spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/3956-143-0x0000000000400000-0x0000000000418000-memory.dmp	family_isrstealer
behavioral2/memory/3956-146-0x0000000000400000-0x0000000000418000-memory.dmp	family_isrstealer
behavioral2/memory/3956-147-0x0000000000400000-0x0000000000418000-memory.dmp	family_isrstealer
behavioral2/memory/3956-148-0x0000000000400000-0x0000000000418000-memory.dmp	family_isrstealer
behavioral2/memory/3956-155-0x0000000000400000-0x0000000000418000-memory.dmp	family_isrstealer

Executes dropped EXE 2 IoCs

pid	Process
1596	240649250.exe
4676	240649250.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3956-140-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/3956-142-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/3956-143-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/3956-146-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/3956-147-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/3956-148-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/3956-155-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4076 set thread context of 3956	4076	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe	87
PID 1596 set thread context of 4676	1596	240649250.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3956	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe
3956	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe
3956	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe
3956	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe
3956	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe
3956	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe
3956	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe
3956	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4076	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe
1596	240649250.exe
3956	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 1596	4076	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe	85
PID 4076 wrote to memory of 1596	4076	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe	85
PID 4076 wrote to memory of 1596	4076	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe	85
PID 4076 wrote to memory of 3956	4076	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe	87
PID 4076 wrote to memory of 3956	4076	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe	87
PID 4076 wrote to memory of 3956	4076	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe	87
PID 4076 wrote to memory of 3956	4076	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe	87
PID 4076 wrote to memory of 3956	4076	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe	87
PID 4076 wrote to memory of 3956	4076	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe	87
PID 4076 wrote to memory of 3956	4076	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe	87
PID 4076 wrote to memory of 3956	4076	c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe	87
PID 1596 wrote to memory of 4676	1596	240649250.exe	88
PID 1596 wrote to memory of 4676	1596	240649250.exe	88
PID 1596 wrote to memory of 4676	1596	240649250.exe	88
PID 1596 wrote to memory of 4676	1596	240649250.exe	88
PID 1596 wrote to memory of 4676	1596	240649250.exe	88
PID 1596 wrote to memory of 4676	1596	240649250.exe	88
PID 1596 wrote to memory of 4676	1596	240649250.exe	88
PID 1596 wrote to memory of 4676	1596	240649250.exe	88

C:\Users\Admin\AppData\Local\Temp\c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe
"C:\Users\Admin\AppData\Local\Temp\c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\240649250.exe
  "C:\Users\Admin\AppData\Local\Temp\240649250.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Users\Admin\AppData\Local\Temp\240649250.exe
    "C:\Users\Admin\AppData\Local\Temp\240649250.exe"
    3⤵
    - Executes dropped EXE
    PID:4676
- C:\Users\Admin\AppData\Local\Temp\c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe
  "C:\Users\Admin\AppData\Local\Temp\c9c15c614ea8a43be81ad6da31b320a1577f142ee1ec84e498bede89d360bdb3.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240649250.exe

Filesize
312KB

MD5
c907917088779ac7dd2c35f1255846a0

SHA1
eecdc166d70455d180276f3cc592d92fe4659c90

SHA256
bcd73949ff5780c5dc60019c1d211bc926009b5fe81b47ee29fd88b05c87e200

SHA512
6cde845481acc502ac1a1baa64fc264bf3400b1fdb165971550081a7f8ccba8ee749e4994c3a61348b6048b06540842884078ad0891185897d1155d15090d0e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\240649250.exe

Filesize
312KB

MD5
c907917088779ac7dd2c35f1255846a0

SHA1
eecdc166d70455d180276f3cc592d92fe4659c90

SHA256
bcd73949ff5780c5dc60019c1d211bc926009b5fe81b47ee29fd88b05c87e200

SHA512
6cde845481acc502ac1a1baa64fc264bf3400b1fdb165971550081a7f8ccba8ee749e4994c3a61348b6048b06540842884078ad0891185897d1155d15090d0e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\240649250.exe

Filesize
312KB

MD5
c907917088779ac7dd2c35f1255846a0

SHA1
eecdc166d70455d180276f3cc592d92fe4659c90

SHA256
bcd73949ff5780c5dc60019c1d211bc926009b5fe81b47ee29fd88b05c87e200

SHA512
6cde845481acc502ac1a1baa64fc264bf3400b1fdb165971550081a7f8ccba8ee749e4994c3a61348b6048b06540842884078ad0891185897d1155d15090d0e1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2971393436-602173351-1645505021-1000\699c4b9cdebca7aaea5193cae8a50098_957af1f1-6875-4c40-9804-a0dcc430f453

Filesize
50B

MD5
5b63d4dd8c04c88c0e30e494ec6a609a

SHA1
884d5a8bdc25fe794dc22ef9518009dcf0069d09

SHA256
4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd

SHA512
15ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb

Download Submit
memory/3956-147-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3956-143-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3956-146-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3956-142-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3956-148-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3956-140-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3956-155-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4676-151-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4676-154-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing