Overview

overview

10

Static

static

3

baeaafc9f3...87.exe

windows7-x64

10

baeaafc9f3...87.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    baeaafc9f3d5c944ee7e39d2103e3c87

  • Size

    969KB

  • Sample

    240308-lkcnyabg47

  • MD5

    baeaafc9f3d5c944ee7e39d2103e3c87

  • SHA1

    5f2e3c22c8fe2dcfbf8df53ba837cdc0c892f054

  • SHA256

    33e595babcf67d43afe50976ab1a20f58c8d737b723fbea915943e89d400e6cb

  • SHA512

    1b7fae35efd59c1816d50da18eba16ae7d7d014b81c5a773b3a72d03cbc40d8e0a19ae3737f75d595fc4ea5c2c213a42c245c07e0256e1269911823b653654af

  • SSDEEP

    24576:BijCOCdlBNl2HvLxeRNEA/qeRdbfSsfFvEQWQeUoZ7U33SAddBLS:BiGrdlfl2PtsNEA/qe3bKQFvbePOHSAc

Score
10/10
isrstealerpersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      baeaafc9f3d5c944ee7e39d2103e3c87

    • Size

      969KB

    • MD5

      baeaafc9f3d5c944ee7e39d2103e3c87

    • SHA1

      5f2e3c22c8fe2dcfbf8df53ba837cdc0c892f054

    • SHA256

      33e595babcf67d43afe50976ab1a20f58c8d737b723fbea915943e89d400e6cb

    • SHA512

      1b7fae35efd59c1816d50da18eba16ae7d7d014b81c5a773b3a72d03cbc40d8e0a19ae3737f75d595fc4ea5c2c213a42c245c07e0256e1269911823b653654af

    • SSDEEP

      24576:BijCOCdlBNl2HvLxeRNEA/qeRdbfSsfFvEQWQeUoZ7U33SAddBLS:BiGrdlfl2PtsNEA/qe3bKQFvbePOHSAc

    Score
    10/10
    isrstealerpersistencespywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks