isrstealer | 18084e63240d9f1ddc54d98136c7c9c1aec4ea33e042a99c16191c00200ba735

General

Target

2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe
Size

284KB
MD5

2348cfa2799bbcb8c873f104cdb8fb8a
SHA1

1d5f42a4bbdc0c555ec8d0a8c236f5c7bb26d4da
SHA256

18084e63240d9f1ddc54d98136c7c9c1aec4ea33e042a99c16191c00200ba735
SHA512

51101724f1434d3acf48a4136149e90dbbb9926e284d1ffb73d7612f397b8efc101cbadafc6df117964d905c02d1c462c109e340762259e853e013dd394b217f
SSDEEP

6144:T1dlZro5ytFzpWs32LlTY5DljE0aZNrUJ/B/+FN9/WN0:T1dlZo5yVWs32NY11Go3mNRo0

Score

10^/10

isrstealer spyware stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2548-31-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/2444-49-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/2548-54-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Executes dropped EXE 4 IoCs

Processes:

prueba.exeprueba.exeprobando.exeprobando.exe

pid process

2564 prueba.exe
2548 prueba.exe
2776 probando.exe
2444 probando.exe

pid	process
2564	prueba.exe
2548	prueba.exe
2776	probando.exe
2444	probando.exe

Loads dropped DLL 3 IoCs

Processes:

2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe

pid	process
2340	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe
2340	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe
2340	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 2 IoCs

Processes:

prueba.exeprobando.exe

description	pid	process	target process
PID 2564 set thread context of 2548	2564	prueba.exe	prueba.exe
PID 2776 set thread context of 2444	2776	probando.exe	probando.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

Processes:

prueba.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database	prueba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset	prueba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage	prueba.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

prueba.exe

pid process

2548 prueba.exe
2548 prueba.exe
2548 prueba.exe
2548 prueba.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

prueba.exeprueba.exe

pid process

2564 prueba.exe
2548 prueba.exe

pid	process
2548	prueba.exe
2548	prueba.exe
2548	prueba.exe
2548	prueba.exe

pid	process
2564	prueba.exe
2548	prueba.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exeprueba.exeprobando.exe

description	pid	process	target process
PID 2340 wrote to memory of 2564	2340	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe	prueba.exe
PID 2340 wrote to memory of 2564	2340	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe	prueba.exe
PID 2340 wrote to memory of 2564	2340	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe	prueba.exe
PID 2340 wrote to memory of 2564	2340	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe	prueba.exe
PID 2564 wrote to memory of 2548	2564	prueba.exe	prueba.exe
PID 2564 wrote to memory of 2548	2564	prueba.exe	prueba.exe
PID 2564 wrote to memory of 2548	2564	prueba.exe	prueba.exe
PID 2564 wrote to memory of 2548	2564	prueba.exe	prueba.exe
PID 2564 wrote to memory of 2548	2564	prueba.exe	prueba.exe
PID 2564 wrote to memory of 2548	2564	prueba.exe	prueba.exe
PID 2564 wrote to memory of 2548	2564	prueba.exe	prueba.exe
PID 2564 wrote to memory of 2548	2564	prueba.exe	prueba.exe
PID 2564 wrote to memory of 2548	2564	prueba.exe	prueba.exe
PID 2340 wrote to memory of 2776	2340	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe	probando.exe
PID 2340 wrote to memory of 2776	2340	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe	probando.exe
PID 2340 wrote to memory of 2776	2340	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe	probando.exe
PID 2340 wrote to memory of 2776	2340	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe	probando.exe
PID 2776 wrote to memory of 2444	2776	probando.exe	probando.exe
PID 2776 wrote to memory of 2444	2776	probando.exe	probando.exe
PID 2776 wrote to memory of 2444	2776	probando.exe	probando.exe
PID 2776 wrote to memory of 2444	2776	probando.exe	probando.exe
PID 2776 wrote to memory of 2444	2776	probando.exe	probando.exe
PID 2776 wrote to memory of 2444	2776	probando.exe	probando.exe
PID 2776 wrote to memory of 2444	2776	probando.exe	probando.exe
PID 2776 wrote to memory of 2444	2776	probando.exe	probando.exe

C:\Users\Admin\AppData\Local\Temp\2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Extracted\prueba.exe
  "C:\Extracted\prueba.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Extracted\prueba.exe
    C:\Extracted\prueba.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2548
- C:\Extracted\probando.exe
  "C:\Extracted\probando.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Extracted\probando.exe
    C:\Extracted\probando.exe
    3⤵
    - Executes dropped EXE
    PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sfx.ini

Filesize
197B

MD5
3fa4be6381dc27324a631eaa844c2b79

SHA1
f1b8f823b55a9a6c6e8120dd4a872f8c1e43d274

SHA256
999723ff8db741690053c4f0101f8ab212c7e11490761065c2804255ccb1d631

SHA512
875e6044dc00e35ba560728c14beb5d3c9f6b41b023f7d6382411c1a2f78b26385dca0ecd9e5e875c4517b5360081f639e96e5699671406ce995ade5ffc8a0fc

Download Submit
\Extracted\probando.exe

Filesize
169KB

MD5
20c709b98a9cde5640b2ac7225b1017c

SHA1
299e8dcd4aa5f0979b929721456ce20f5c818603

SHA256
5449e58a7ac5add1bf29fea34e52af5c0b19fa6c307e96311acd949b45ad8e32

SHA512
78a7e6d5ff044a301c33763d36a9161e1ff3dd62ee57c46174598fdb0a95b72e0055efd923d69dddc0373f3b81b6e83b977f7329d1043e0950ab384777db7fd6

Download Submit
\Extracted\prueba.exe

Filesize
131KB

MD5
1071976c7372ca69ee12be54eaf5c8dc

SHA1
2e18664e7590103b616aded9dbe4f9f61c6a6f49

SHA256
5809a144d1acd6c9881b0c3cdf20d15628d4d0d8e56f252f7acf326bcfc921cf

SHA512
120ae9546e575b2c30a20b46a831fd36b30282706a387037f18264aebf4f879c5c4fd0c8ccb81fcde6b0319bc256a7c005483368806463bbfe4476f9f28a6455

Download Submit
memory/2340-26-0x0000000002570000-0x0000000002595000-memory.dmp

Filesize
148KB

Download
memory/2444-45-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2444-51-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2444-49-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2444-47-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2548-31-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2548-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2564-27-0x0000000000400000-0x0000000000424200-memory.dmp

Filesize
144KB

Download
memory/2564-36-0x0000000000400000-0x0000000000424200-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads