Malware Analysis Report

2024-10-19 10:27

Sample ID 240313-dmr8eadc96
Target c4d20a36d9f0e1ca758818b3be981779
SHA256 1fbf779d7f1d4dfe9cd3f7c84c6e5763bb77530acc11732563e7abaeaba65a93
Tags
isrstealer persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1fbf779d7f1d4dfe9cd3f7c84c6e5763bb77530acc11732563e7abaeaba65a93

Threat Level: Known bad

The file c4d20a36d9f0e1ca758818b3be981779 was found to be: Known bad.

Malicious Activity Summary

isrstealer persistence spyware stealer trojan

ISR Stealer

ISR Stealer payload

Reads user/profile data of web browsers

Loads dropped DLL

Reads data files stored by FTP clients

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-13 03:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-13 03:07

Reported

2024-03-13 03:10

Platform

win7-20231129-en

Max time kernel

141s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe"

Signatures

ISR Stealer

trojan stealer isrstealer

ISR Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\RegEdit = "C:\\Users\\Admin\\AppData\\Roaming\\RegEdit.exe" C:\Users\Admin\AppData\Local\Temp\tmp2.EXE N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2172 set thread context of 2720 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 1732 set thread context of 2524 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp1.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2340 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe C:\Users\Admin\AppData\Local\Temp\tmp1.exe
PID 2340 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe C:\Users\Admin\AppData\Local\Temp\tmp1.exe
PID 2340 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe C:\Users\Admin\AppData\Local\Temp\tmp1.exe
PID 2340 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe C:\Users\Admin\AppData\Local\Temp\tmp1.exe
PID 2340 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe C:\Users\Admin\AppData\Local\Temp\tmp2.exe
PID 2340 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe C:\Users\Admin\AppData\Local\Temp\tmp2.exe
PID 2340 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe C:\Users\Admin\AppData\Local\Temp\tmp2.exe
PID 2340 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe C:\Users\Admin\AppData\Local\Temp\tmp2.exe
PID 2172 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 2172 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 2172 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 2172 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 2172 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 2172 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 2172 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 2172 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 2172 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 1732 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 1732 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 1732 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 1732 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 1732 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 1732 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 1732 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 1732 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 1732 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 1732 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 1732 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe

"C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe"

C:\Users\Admin\AppData\Local\Temp\tmp1.exe

"C:\Users\Admin\AppData\Local\Temp\tmp1.exe"

C:\Users\Admin\AppData\Local\Temp\tmp2.exe

"C:\Users\Admin\AppData\Local\Temp\tmp2.exe"

C:\Users\Admin\AppData\Local\Temp\tmp1.EXE

"C:\Users\Admin\AppData\Local\Temp\tmp1.EXE"

C:\Users\Admin\AppData\Local\Temp\tmp2.EXE

"C:\Users\Admin\AppData\Local\Temp\tmp2.EXE"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ljcp.gov.pk udp
US 8.8.8.8:53 www.mymobilewap.info udp
PK 175.107.60.195:80 ljcp.gov.pk tcp

Files

memory/2340-0-0x0000000000400000-0x000000000043C000-memory.dmp

\Users\Admin\AppData\Local\Temp\tmp1.exe

MD5 c1cfb778cbfe135b6fb0d2b6b9116b38
SHA1 f90af1a915f603a6acc40c18a5d9e8e6eef8d015
SHA256 b5d32c93e9a815f775489aa2b0ab1f86d45821df344916237746557062d7e8fb
SHA512 8ca72c995233c5c14eb9d1b6d6b1b70f72f03acbfb578743b0da8bce03b36d0d2d7e005feefb2fffd55f803e41f9e17b5be8ccc5a333a34d426545fbb6443b0a

C:\Users\Admin\AppData\Local\Temp\tmp2.exe

MD5 f0c93f442042bbbe985674d671191ed3
SHA1 a9ebbe67032eec48673b42325682859ce06a5e2c
SHA256 9708ceb9b7f76534315948101b2c8493d0c96e8205eee25e7b8a5473f65b997e
SHA512 7e8978c682d0e735f8f7bc16d1fb99136e927c7dc1d6e0fe5be41f0ec0808af9203bf146653f9fe4ac806c91f532144f5b27ac2b9adcb7b3876d4ab02a75e776

memory/2524-32-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2720-31-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2340-27-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2524-39-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2524-41-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2524-43-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2720-45-0x0000000000400000-0x0000000000414000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-13 03:07

Reported

2024-03-13 03:10

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe"

Signatures

ISR Stealer

trojan stealer isrstealer

ISR Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegEdit = "C:\\Users\\Admin\\AppData\\Roaming\\RegEdit.exe" C:\Users\Admin\AppData\Local\Temp\tmp2.EXE N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5000 set thread context of 2568 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 2356 set thread context of 2168 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5032 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe C:\Users\Admin\AppData\Local\Temp\tmp1.exe
PID 5032 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe C:\Users\Admin\AppData\Local\Temp\tmp1.exe
PID 5032 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe C:\Users\Admin\AppData\Local\Temp\tmp1.exe
PID 5032 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe C:\Users\Admin\AppData\Local\Temp\tmp2.exe
PID 5032 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe C:\Users\Admin\AppData\Local\Temp\tmp2.exe
PID 5032 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe C:\Users\Admin\AppData\Local\Temp\tmp2.exe
PID 5000 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 5000 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 5000 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 2356 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 2356 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 2356 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 5000 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 2356 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 5000 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 5000 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 2356 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 5000 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 2356 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 2356 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 2356 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 2356 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE
PID 5000 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\tmp1.exe C:\Users\Admin\AppData\Local\Temp\tmp1.EXE
PID 2356 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe

"C:\Users\Admin\AppData\Local\Temp\c4d20a36d9f0e1ca758818b3be981779.exe"

C:\Users\Admin\AppData\Local\Temp\tmp1.exe

"C:\Users\Admin\AppData\Local\Temp\tmp1.exe"

C:\Users\Admin\AppData\Local\Temp\tmp2.exe

"C:\Users\Admin\AppData\Local\Temp\tmp2.exe"

C:\Users\Admin\AppData\Local\Temp\tmp1.EXE

"C:\Users\Admin\AppData\Local\Temp\tmp1.EXE"

C:\Users\Admin\AppData\Local\Temp\tmp2.EXE

"C:\Users\Admin\AppData\Local\Temp\tmp2.EXE"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.mymobilewap.info udp
US 8.8.8.8:53 ljcp.gov.pk udp
PK 175.107.60.195:80 ljcp.gov.pk tcp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 195.60.107.175.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 www.mymobilewap.info udp
US 8.8.8.8:53 www.mymobilewap.info udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 www.mymobilewap.info udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 www.mymobilewap.info udp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp

Files

memory/5032-0-0x0000000000400000-0x000000000043C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1.exe

MD5 c1cfb778cbfe135b6fb0d2b6b9116b38
SHA1 f90af1a915f603a6acc40c18a5d9e8e6eef8d015
SHA256 b5d32c93e9a815f775489aa2b0ab1f86d45821df344916237746557062d7e8fb
SHA512 8ca72c995233c5c14eb9d1b6d6b1b70f72f03acbfb578743b0da8bce03b36d0d2d7e005feefb2fffd55f803e41f9e17b5be8ccc5a333a34d426545fbb6443b0a

C:\Users\Admin\AppData\Local\Temp\tmp2.exe

MD5 f0c93f442042bbbe985674d671191ed3
SHA1 a9ebbe67032eec48673b42325682859ce06a5e2c
SHA256 9708ceb9b7f76534315948101b2c8493d0c96e8205eee25e7b8a5473f65b997e
SHA512 7e8978c682d0e735f8f7bc16d1fb99136e927c7dc1d6e0fe5be41f0ec0808af9203bf146653f9fe4ac806c91f532144f5b27ac2b9adcb7b3876d4ab02a75e776

C:\Users\Admin\AppData\Local\Temp\tmp2.exe

MD5 19be60d8ce45d71cba9166cc9000a265
SHA1 2d6ede4da37200698d51624605f7e8bbc05da363
SHA256 14b3e98b1bfbf89b2631741eb3c7116351dd08c52081b88519043c14a6f9b1c5
SHA512 cd615f665b7d3279bd5ede2bf0155593039ff3d69d948a2289a2baa2b17bb6ef451246385f5968b9a0329c34d25586768987de399d9073f168a5e40fcb2a2016

C:\Users\Admin\AppData\Local\Temp\tmp2.exe

MD5 4eb6b67e77fa490b97926583d79d7e0d
SHA1 149e480b4fadfff351faac91f03a96a0382c2dc9
SHA256 6391f472e0b8866b4db818f2d13daf8beca8d77918d712dfc3307582d40e10d0
SHA512 2c49766d2ce7e693abfd25ddff14c3ae43af20d236d44ac4ffa4a332786c41d955c52ab1aac9593f03cd66f5c3c67850b13e62a4a27ad0b86647397dfab200f4

memory/2568-30-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2168-35-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2568-36-0x0000000000400000-0x0000000000414000-memory.dmp

memory/5032-38-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2168-37-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2168-31-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2168-41-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2568-44-0x0000000000400000-0x0000000000414000-memory.dmp