isrstealer | 5449e58a7ac5add1bf29fea34e52af5c0b19fa6c307e96311acd949b45ad8e32

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 02:30

Target

20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe
Size

169KB
MD5

20c709b98a9cde5640b2ac7225b1017c
SHA1

299e8dcd4aa5f0979b929721456ce20f5c818603
SHA256

5449e58a7ac5add1bf29fea34e52af5c0b19fa6c307e96311acd949b45ad8e32
SHA512

78a7e6d5ff044a301c33763d36a9161e1ff3dd62ee57c46174598fdb0a95b72e0055efd923d69dddc0373f3b81b6e83b977f7329d1043e0950ab384777db7fd6
SSDEEP

3072:ri/uRTXmpMzYt2GKD+yncYuNqsGfpUm9P2wuCKedI30EfHkK2fsYQrXvZBEuNFd:rimRTXmyoyfuosGfpUm9xuL0EfHkKQMN

Score

10^/10

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1280-11-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1280-7-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Suspicious use of SetThreadContext 1 IoCs

Processes:

20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe

description	pid	process	target process
PID 2228 set thread context of 1280	2228	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe

description	pid	process	target process
PID 2228 wrote to memory of 1280	2228	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe
PID 2228 wrote to memory of 1280	2228	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe
PID 2228 wrote to memory of 1280	2228	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe
PID 2228 wrote to memory of 1280	2228	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe
PID 2228 wrote to memory of 1280	2228	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe
PID 2228 wrote to memory of 1280	2228	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe
PID 2228 wrote to memory of 1280	2228	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe
PID 2228 wrote to memory of 1280	2228	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe
  2⤵
  PID:1280

memory/1280-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1280-11-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1280-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1280-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1280-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2228-0-0x00000000746A1000-0x00000000746A2000-memory.dmp

Filesize
4KB

Download
memory/2228-1-0x00000000746A0000-0x0000000074C4B000-memory.dmp

Filesize
5.7MB

Download
memory/2228-2-0x00000000746A0000-0x0000000074C4B000-memory.dmp

Filesize
5.7MB

Download
memory/2228-12-0x00000000746A0000-0x0000000074C4B000-memory.dmp

Filesize
5.7MB

Download