isrstealer | a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe

General

Target

a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe
Size

121KB
MD5

8b6ee5274dca9075af87729fcad6c0f7
SHA1

a794785786d904390533f6a909715060fbb77286
SHA256

a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe
SHA512

112568d672a387e6977bc9e1b7c9a898685abdf841b01e4d2d39aa4942b739151d316032291298b4ecf7fd572232963243f10dbde0e99a884cc12d1d514c851a
SSDEEP

1536:+m1FG8XzZpMlOSYJFBewurwYwn66LpSfQUV7Wtr4G6kBUkGS4Je5Q/yKRyPsIGvl:7QWuNY0rc6ESUU5S4Je5EyKR+sIG/l

Score

10^/10

isrstealer spyware stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/1724-61-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1724-67-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1724-68-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Executes dropped EXE 1 IoCs

pid	Process
1724	poer.exe

Loads dropped DLL 2 IoCs

pid	Process
1200	a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe
1200	a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1200 set thread context of 1724	1200	a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1724	poer.exe
1724	poer.exe
1724	poer.exe
1724	poer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1724	poer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1724	1200	a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe	28
PID 1200 wrote to memory of 1724	1200	a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe	28
PID 1200 wrote to memory of 1724	1200	a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe	28
PID 1200 wrote to memory of 1724	1200	a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe	28
PID 1200 wrote to memory of 1724	1200	a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe	28
PID 1200 wrote to memory of 1724	1200	a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe	28
PID 1200 wrote to memory of 1724	1200	a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe	28
PID 1200 wrote to memory of 1724	1200	a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe	28
PID 1200 wrote to memory of 1724	1200	a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe	28

C:\Users\Admin\AppData\Local\Temp\a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe
"C:\Users\Admin\AppData\Local\Temp\a30731a0007f106e4a12709ae7f5f4de133b20de59de10cd86b211d216779dbe.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Roaming\poer.exe
  C:\Users\Admin\AppData\Roaming\poer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\poer.exe

Filesize
1KB

MD5
0df5b5319b99007441a57e8fd0b8727b

SHA1
73f1d54d460f84a68973e3a6fb56959dd853be5b

SHA256
27a7ef5bf4f9f5f9ef0a302ac52863759b09541812196fb819b8b5779b029ffc

SHA512
563a801957a073c1ccfc90a420cc1345f695dbf85ce0afdc5a1cb4d6ef479cdf9dde178d3c2d6216638b4a6a05e32dacc6f0bf8c3b097416b495b9642e1ef9a6

Download Submit
C:\Users\Admin\AppData\Roaming\poer.exe

Filesize
1KB

MD5
0df5b5319b99007441a57e8fd0b8727b

SHA1
73f1d54d460f84a68973e3a6fb56959dd853be5b

SHA256
27a7ef5bf4f9f5f9ef0a302ac52863759b09541812196fb819b8b5779b029ffc

SHA512
563a801957a073c1ccfc90a420cc1345f695dbf85ce0afdc5a1cb4d6ef479cdf9dde178d3c2d6216638b4a6a05e32dacc6f0bf8c3b097416b495b9642e1ef9a6

Download Submit
\Users\Admin\AppData\Roaming\poer.exe

Filesize
1KB

MD5
0df5b5319b99007441a57e8fd0b8727b

SHA1
73f1d54d460f84a68973e3a6fb56959dd853be5b

SHA256
27a7ef5bf4f9f5f9ef0a302ac52863759b09541812196fb819b8b5779b029ffc

SHA512
563a801957a073c1ccfc90a420cc1345f695dbf85ce0afdc5a1cb4d6ef479cdf9dde178d3c2d6216638b4a6a05e32dacc6f0bf8c3b097416b495b9642e1ef9a6

Download Submit
\Users\Admin\AppData\Roaming\poer.exe

Filesize
1KB

MD5
0df5b5319b99007441a57e8fd0b8727b

SHA1
73f1d54d460f84a68973e3a6fb56959dd853be5b

SHA256
27a7ef5bf4f9f5f9ef0a302ac52863759b09541812196fb819b8b5779b029ffc

SHA512
563a801957a073c1ccfc90a420cc1345f695dbf85ce0afdc5a1cb4d6ef479cdf9dde178d3c2d6216638b4a6a05e32dacc6f0bf8c3b097416b495b9642e1ef9a6

Download Submit
memory/1724-61-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1724-67-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1724-68-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing