isrstealer | 18084e63240d9f1ddc54d98136c7c9c1aec4ea33e042a99c16191c00200ba735

General

Target

2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe
Size

284KB
MD5

2348cfa2799bbcb8c873f104cdb8fb8a
SHA1

1d5f42a4bbdc0c555ec8d0a8c236f5c7bb26d4da
SHA256

18084e63240d9f1ddc54d98136c7c9c1aec4ea33e042a99c16191c00200ba735
SHA512

51101724f1434d3acf48a4136149e90dbbb9926e284d1ffb73d7612f397b8efc101cbadafc6df117964d905c02d1c462c109e340762259e853e013dd394b217f
SSDEEP

6144:T1dlZro5ytFzpWs32LlTY5DljE0aZNrUJ/B/+FN9/WN0:T1dlZo5yVWs32NY11Go3mNRo0

Score

10^/10

isrstealer spyware stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/4312-28-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/4312-31-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/4312-53-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/4312-54-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe

Executes dropped EXE 4 IoCs

pid	Process
4168	prueba.exe
4312	prueba.exe
4680	probando.exe
1504	probando.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4168 set thread context of 4312	4168	prueba.exe	82
PID 4680 set thread context of 1504	4680	probando.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2128	1504	WerFault.exe	84

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage	prueba.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\MIME\Database	prueba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset	prueba.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4312	prueba.exe
4312	prueba.exe
4312	prueba.exe
4312	prueba.exe
4312	prueba.exe
4312	prueba.exe
4312	prueba.exe
4312	prueba.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4168	prueba.exe
4312	prueba.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1504	probando.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 4168	1920	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe	81
PID 1920 wrote to memory of 4168	1920	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe	81
PID 1920 wrote to memory of 4168	1920	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe	81
PID 4168 wrote to memory of 4312	4168	prueba.exe	82
PID 4168 wrote to memory of 4312	4168	prueba.exe	82
PID 4168 wrote to memory of 4312	4168	prueba.exe	82
PID 4168 wrote to memory of 4312	4168	prueba.exe	82
PID 4168 wrote to memory of 4312	4168	prueba.exe	82
PID 4168 wrote to memory of 4312	4168	prueba.exe	82
PID 4168 wrote to memory of 4312	4168	prueba.exe	82
PID 4168 wrote to memory of 4312	4168	prueba.exe	82
PID 1920 wrote to memory of 4680	1920	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe	83
PID 1920 wrote to memory of 4680	1920	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe	83
PID 1920 wrote to memory of 4680	1920	2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe	83
PID 4680 wrote to memory of 1504	4680	probando.exe	84
PID 4680 wrote to memory of 1504	4680	probando.exe	84
PID 4680 wrote to memory of 1504	4680	probando.exe	84
PID 4680 wrote to memory of 1504	4680	probando.exe	84
PID 4680 wrote to memory of 1504	4680	probando.exe	84
PID 4680 wrote to memory of 1504	4680	probando.exe	84
PID 4680 wrote to memory of 1504	4680	probando.exe	84
PID 4680 wrote to memory of 1504	4680	probando.exe	84

C:\Users\Admin\AppData\Local\Temp\2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2348cfa2799bbcb8c873f104cdb8fb8a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Extracted\prueba.exe
  "C:\Extracted\prueba.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Extracted\prueba.exe
    C:\Extracted\prueba.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4312
- C:\Extracted\probando.exe
  "C:\Extracted\probando.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Extracted\probando.exe
    C:\Extracted\probando.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of UnmapMainImage
    PID:1504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 12
      4⤵
      Program crash
      PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1504 -ip 1504
1⤵
PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Extracted\probando.exe

Filesize
169KB

MD5
20c709b98a9cde5640b2ac7225b1017c

SHA1
299e8dcd4aa5f0979b929721456ce20f5c818603

SHA256
5449e58a7ac5add1bf29fea34e52af5c0b19fa6c307e96311acd949b45ad8e32

SHA512
78a7e6d5ff044a301c33763d36a9161e1ff3dd62ee57c46174598fdb0a95b72e0055efd923d69dddc0373f3b81b6e83b977f7329d1043e0950ab384777db7fd6

Download Submit
C:\Extracted\prueba.exe

Filesize
131KB

MD5
1071976c7372ca69ee12be54eaf5c8dc

SHA1
2e18664e7590103b616aded9dbe4f9f61c6a6f49

SHA256
5809a144d1acd6c9881b0c3cdf20d15628d4d0d8e56f252f7acf326bcfc921cf

SHA512
120ae9546e575b2c30a20b46a831fd36b30282706a387037f18264aebf4f879c5c4fd0c8ccb81fcde6b0319bc256a7c005483368806463bbfe4476f9f28a6455

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfx.ini

Filesize
197B

MD5
3fa4be6381dc27324a631eaa844c2b79

SHA1
f1b8f823b55a9a6c6e8120dd4a872f8c1e43d274

SHA256
999723ff8db741690053c4f0101f8ab212c7e11490761065c2804255ccb1d631

SHA512
875e6044dc00e35ba560728c14beb5d3c9f6b41b023f7d6382411c1a2f78b26385dca0ecd9e5e875c4517b5360081f639e96e5699671406ce995ade5ffc8a0fc

Download Submit
memory/4168-35-0x0000000000400000-0x0000000000424200-memory.dmp

Filesize
144KB

Download
memory/4168-25-0x0000000000400000-0x0000000000424200-memory.dmp

Filesize
144KB

Download
memory/4312-28-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4312-31-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4312-53-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4312-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4680-46-0x0000000072C92000-0x0000000072C93000-memory.dmp

Filesize
4KB

Download
memory/4680-47-0x0000000072C90000-0x0000000073241000-memory.dmp

Filesize
5.7MB

Download
memory/4680-48-0x0000000072C90000-0x0000000073241000-memory.dmp

Filesize
5.7MB

Download
memory/4680-52-0x0000000072C90000-0x0000000073241000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing