isrstealer | 77eb02d972ac37ee02210a3ba0ae73a0f2e904e6c40aa46507354aa6e9ed46ed

General

Target

00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe
Size

284KB
MD5

00ea206f316981790d5eedc6aaf23d00
SHA1

b9c553609b00b3b626d55505d3a0d112672d43b6
SHA256

77eb02d972ac37ee02210a3ba0ae73a0f2e904e6c40aa46507354aa6e9ed46ed
SHA512

08c20d978527f4e943616e83282f01b295c300134a737c6022c2ccc967fea227c820eded3780213fe6580cb3d93976ad4d493dbb1ab420b2b1b68c27f4561a2e
SSDEEP

6144:RT74IZNWcMeBNTlJV/oHWFQnx85FfUUE8rMrsqpyaQ74dtI:jLBbvoHVxMJUUE8rMrsqQrMdm

Score

10^/10

isrstealer spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/2364-2-0x0000000000400000-0x0000000000432000-memory.dmp	family_isrstealer
behavioral1/memory/2364-17-0x0000000000400000-0x0000000000432000-memory.dmp	family_isrstealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2996-7-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2996-9-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2996-10-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2996-12-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2996-11-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2996-16-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 2364	2100	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	28
PID 2364 set thread context of 2996	2364	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	29

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2100	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe
2364	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2364	2100	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	28
PID 2100 wrote to memory of 2364	2100	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	28
PID 2100 wrote to memory of 2364	2100	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	28
PID 2100 wrote to memory of 2364	2100	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	28
PID 2100 wrote to memory of 2364	2100	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	28
PID 2100 wrote to memory of 2364	2100	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	28
PID 2100 wrote to memory of 2364	2100	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	28
PID 2100 wrote to memory of 2364	2100	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	28
PID 2100 wrote to memory of 2364	2100	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	28
PID 2364 wrote to memory of 2996	2364	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	29
PID 2364 wrote to memory of 2996	2364	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	29
PID 2364 wrote to memory of 2996	2364	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	29
PID 2364 wrote to memory of 2996	2364	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	29
PID 2364 wrote to memory of 2996	2364	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	29
PID 2364 wrote to memory of 2996	2364	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	29
PID 2364 wrote to memory of 2996	2364	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	29
PID 2364 wrote to memory of 2996	2364	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	29
PID 2364 wrote to memory of 2996	2364	00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"
    3⤵
    PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2364-2-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2364-17-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2996-7-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2996-9-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2996-10-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2996-12-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2996-11-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2996-16-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing