isrstealer | 95f5e8a8f81cc22aa687cf82e0d6cadbf130f25018fa0097710927ed40d2f939

General

Target

b42e7395d548094719753ce21cafc064.exe
Size

500KB
MD5

b42e7395d548094719753ce21cafc064
SHA1

6baed6fc826f81aa77cbd71945c46d44c04718e4
SHA256

95f5e8a8f81cc22aa687cf82e0d6cadbf130f25018fa0097710927ed40d2f939
SHA512

52d741889f330dddfa97897c3b642fbd7a05364b1122e794a4deab0d4c2214f6629b2e03727f5422161fff4d83e82b93866339623917b88e8123fc271a6a4557
SSDEEP

12288:G3s06nf8okk8kGfCIcgiLTXWswMGMv0MSPmIQWe:BPfkkZ8diLjXzGySPm7We

Score

10^/10

isrstealer bootkit persistence stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012260-19.dat	family_isrstealer

Executes dropped EXE 2 IoCs

pid	Process
2672	mw_111221_passwd.exe
2500	mw_111221_vnpanel.exe

Loads dropped DLL 3 IoCs

pid	Process
2236	b42e7395d548094719753ce21cafc064.exe
2236	b42e7395d548094719753ce21cafc064.exe
2236	b42e7395d548094719753ce21cafc064.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\crssr = "C:\\Users\\Admin\\AppData\\Roaming\\crssr"	mw_111221_vnpanel.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b42e7395d548094719753ce21cafc064.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1856 set thread context of 2236	1856	b42e7395d548094719753ce21cafc064.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1856	b42e7395d548094719753ce21cafc064.exe
2236	b42e7395d548094719753ce21cafc064.exe
2672	mw_111221_passwd.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2236	1856	b42e7395d548094719753ce21cafc064.exe	28
PID 1856 wrote to memory of 2236	1856	b42e7395d548094719753ce21cafc064.exe	28
PID 1856 wrote to memory of 2236	1856	b42e7395d548094719753ce21cafc064.exe	28
PID 1856 wrote to memory of 2236	1856	b42e7395d548094719753ce21cafc064.exe	28
PID 1856 wrote to memory of 2236	1856	b42e7395d548094719753ce21cafc064.exe	28
PID 1856 wrote to memory of 2236	1856	b42e7395d548094719753ce21cafc064.exe	28
PID 1856 wrote to memory of 2236	1856	b42e7395d548094719753ce21cafc064.exe	28
PID 1856 wrote to memory of 2236	1856	b42e7395d548094719753ce21cafc064.exe	28
PID 1856 wrote to memory of 2236	1856	b42e7395d548094719753ce21cafc064.exe	28
PID 2236 wrote to memory of 2672	2236	b42e7395d548094719753ce21cafc064.exe	29
PID 2236 wrote to memory of 2672	2236	b42e7395d548094719753ce21cafc064.exe	29
PID 2236 wrote to memory of 2672	2236	b42e7395d548094719753ce21cafc064.exe	29
PID 2236 wrote to memory of 2672	2236	b42e7395d548094719753ce21cafc064.exe	29
PID 2236 wrote to memory of 2500	2236	b42e7395d548094719753ce21cafc064.exe	30
PID 2236 wrote to memory of 2500	2236	b42e7395d548094719753ce21cafc064.exe	30
PID 2236 wrote to memory of 2500	2236	b42e7395d548094719753ce21cafc064.exe	30
PID 2236 wrote to memory of 2500	2236	b42e7395d548094719753ce21cafc064.exe	30

C:\Users\Admin\AppData\Local\Temp\b42e7395d548094719753ce21cafc064.exe
"C:\Users\Admin\AppData\Local\Temp\b42e7395d548094719753ce21cafc064.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\b42e7395d548094719753ce21cafc064.exe
  "C:\Users\Admin\AppData\Local\Temp\b42e7395d548094719753ce21cafc064.exe"
  2⤵
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Users\Admin\AppData\Local\Temp\mw_111221_passwd.exe
    "C:\Users\Admin\AppData\Local\Temp\mw_111221_passwd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2672
- - C:\Users\Admin\AppData\Local\Temp\mw_111221_vnpanel.exe
    "C:\Users\Admin\AppData\Local\Temp\mw_111221_vnpanel.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\mw_111221_passwd.exe

Filesize
76KB

MD5
32c96c4a94e4066cc6eeb2b0d24dfc36

SHA1
d256f6ea46af1c578d96b59d945f00880f9aa4f0

SHA256
02d227751808eb5cd476c91d6b2f8260c812042de78fc04ae3770168f2873f97

SHA512
af0e6c6b8ba9769b5981780740b00bac46c3cc1ae552e5d6a6a29f6eeb4df312e3f39cbd163e5d612125ae2f91173432b6a22aa1dcccc7c5eff9aafad0692fe2

Download Submit
\Users\Admin\AppData\Local\Temp\mw_111221_vnpanel.exe

Filesize
166KB

MD5
16cde6a521edcd5cc7fa9860096f9222

SHA1
b69246e52d0adee6725fd9ec69c7a7b9974b7634

SHA256
cdd686b7f74b3f0224bbc44daffe7fa9cc9309838866f1586d317a7df5e5df6f

SHA512
41ebfe0a023213113e13307d9bcea0f780f9604cdaa444ce73cc720156d2f3868f1f32c585ad2eb8a8bdd60a0d0ba14e1140d1fd484b4cd75de8ff02826869b9

Download Submit
memory/2236-2-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2236-4-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2236-6-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2236-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2236-12-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2236-14-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2236-36-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads