Analysis
-
max time kernel
11s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 01:18
Static task
static1
Behavioral task
behavioral1
Sample
09d716d57edc76d03136a0c475126554.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
09d716d57edc76d03136a0c475126554.exe
Resource
win10v2004-20231222-en
General
-
Target
09d716d57edc76d03136a0c475126554.exe
-
Size
312KB
-
MD5
09d716d57edc76d03136a0c475126554
-
SHA1
cb92a0c2a030ab46da68688dc257f3635b8f8783
-
SHA256
622f6d37e73da72ea2d39f77099ee466e5979e47e1c55c0062855abae923f121
-
SHA512
7ea2e93a807f417307f29a5b552bfd53426206cc8712513c7e4e96d3d2501a75a4c42496d09560b10f6abfdace0e5fae3a106df828a2e691bc43fed86e58ae46
-
SSDEEP
6144:RLa94GN7fiIEAeLHJx01zfs/RjX2cDEuNRxBxCH8e+nHZJlH9V/Eh5zsDjX25hGq:RW94GN7fiIEAeLHJx0VoVsu9CceOJlDe
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2752-43-0x0000000000400000-0x0000000000414000-memory.dmp family_isrstealer behavioral1/memory/2752-50-0x0000000000400000-0x0000000000414000-memory.dmp family_isrstealer behavioral1/memory/2752-39-0x0000000000400000-0x0000000000414000-memory.dmp family_isrstealer behavioral1/memory/2752-51-0x0000000000400000-0x0000000000414000-memory.dmp family_isrstealer behavioral1/memory/2752-53-0x0000000000400000-0x0000000000414000-memory.dmp family_isrstealer -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
09d716d57edc76d03136a0c475126554.exe09d716d57edc76d03136a0c475126554.exedescription ioc process File opened for modification \??\PhysicalDrive0 09d716d57edc76d03136a0c475126554.exe File opened for modification \??\PhysicalDrive0 09d716d57edc76d03136a0c475126554.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
09d716d57edc76d03136a0c475126554.exe09d716d57edc76d03136a0c475126554.exe09d716d57edc76d03136a0c475126554.exedescription pid process target process PID 1272 set thread context of 2984 1272 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 2984 set thread context of 848 2984 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 848 set thread context of 2752 848 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
09d716d57edc76d03136a0c475126554.exepid process 2752 09d716d57edc76d03136a0c475126554.exe 2752 09d716d57edc76d03136a0c475126554.exe 2752 09d716d57edc76d03136a0c475126554.exe 2752 09d716d57edc76d03136a0c475126554.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
09d716d57edc76d03136a0c475126554.exe09d716d57edc76d03136a0c475126554.exe09d716d57edc76d03136a0c475126554.exe09d716d57edc76d03136a0c475126554.exepid process 1272 09d716d57edc76d03136a0c475126554.exe 2984 09d716d57edc76d03136a0c475126554.exe 848 09d716d57edc76d03136a0c475126554.exe 2752 09d716d57edc76d03136a0c475126554.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
09d716d57edc76d03136a0c475126554.exe09d716d57edc76d03136a0c475126554.exe09d716d57edc76d03136a0c475126554.exedescription pid process target process PID 1272 wrote to memory of 2984 1272 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 1272 wrote to memory of 2984 1272 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 1272 wrote to memory of 2984 1272 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 1272 wrote to memory of 2984 1272 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 1272 wrote to memory of 2984 1272 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 1272 wrote to memory of 2984 1272 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 1272 wrote to memory of 2984 1272 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 1272 wrote to memory of 2984 1272 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 1272 wrote to memory of 2984 1272 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 2984 wrote to memory of 848 2984 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 2984 wrote to memory of 848 2984 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 2984 wrote to memory of 848 2984 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 2984 wrote to memory of 848 2984 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 2984 wrote to memory of 848 2984 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 2984 wrote to memory of 848 2984 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 2984 wrote to memory of 848 2984 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 2984 wrote to memory of 848 2984 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 2984 wrote to memory of 848 2984 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 848 wrote to memory of 2752 848 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 848 wrote to memory of 2752 848 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 848 wrote to memory of 2752 848 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 848 wrote to memory of 2752 848 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 848 wrote to memory of 2752 848 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 848 wrote to memory of 2752 848 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 848 wrote to memory of 2752 848 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe PID 848 wrote to memory of 2752 848 09d716d57edc76d03136a0c475126554.exe 09d716d57edc76d03136a0c475126554.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09d716d57edc76d03136a0c475126554.exe"C:\Users\Admin\AppData\Local\Temp\09d716d57edc76d03136a0c475126554.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09d716d57edc76d03136a0c475126554.exe"C:\Users\Admin\AppData\Local\Temp\09d716d57edc76d03136a0c475126554.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09d716d57edc76d03136a0c475126554.exe"C:\Users\Admin\AppData\Local\Temp\09d716d57edc76d03136a0c475126554.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09d716d57edc76d03136a0c475126554.exe"C:\Users\Admin\AppData\Local\Temp\09d716d57edc76d03136a0c475126554.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/848-45-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/848-18-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/848-20-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/848-22-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/848-28-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/848-32-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2752-50-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2752-35-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2752-43-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2752-53-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2752-51-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2752-39-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2752-37-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2984-4-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/2984-6-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/2984-8-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/2984-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2984-12-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/2984-17-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/2984-29-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/2984-2-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB