isrstealer | 5449e58a7ac5add1bf29fea34e52af5c0b19fa6c307e96311acd949b45ad8e32

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 02:30

Target

20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe
Size

169KB
MD5

20c709b98a9cde5640b2ac7225b1017c
SHA1

299e8dcd4aa5f0979b929721456ce20f5c818603
SHA256

5449e58a7ac5add1bf29fea34e52af5c0b19fa6c307e96311acd949b45ad8e32
SHA512

78a7e6d5ff044a301c33763d36a9161e1ff3dd62ee57c46174598fdb0a95b72e0055efd923d69dddc0373f3b81b6e83b977f7329d1043e0950ab384777db7fd6
SSDEEP

3072:ri/uRTXmpMzYt2GKD+yncYuNqsGfpUm9P2wuCKedI30EfHkK2fsYQrXvZBEuNFd:rimRTXmyoyfuosGfpUm9xuL0EfHkKQMN

Score

10^/10

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/1808-3-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4904 set thread context of 1808	4904	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
600	1808	WerFault.exe	80

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1808	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 1808	4904	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	80
PID 4904 wrote to memory of 1808	4904	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	80
PID 4904 wrote to memory of 1808	4904	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	80
PID 4904 wrote to memory of 1808	4904	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	80
PID 4904 wrote to memory of 1808	4904	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	80
PID 4904 wrote to memory of 1808	4904	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	80
PID 4904 wrote to memory of 1808	4904	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	80
PID 4904 wrote to memory of 1808	4904	20c709b98a9cde5640b2ac7225b1017c_JaffaCakes118.exe	80

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1808 -ip 1808
1⤵
PID:1576

memory/1808-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4904-0-0x0000000074842000-0x0000000074843000-memory.dmp

Filesize
4KB

Download
memory/4904-1-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/4904-2-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/4904-5-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download