isrstealer | 2d3fe4f073a6502a68d82492dc5bb16cbf19bda9077f19691eb2e3bb332797f0

General

Target

2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
Size

412KB
MD5

2944332d4754e448152c2e5920af3d42
SHA1

f6b80400eb1e671ecb9737f12fefdc904ade8b08
SHA256

2d3fe4f073a6502a68d82492dc5bb16cbf19bda9077f19691eb2e3bb332797f0
SHA512

52df32e7887c050236debb4e233f71d7c1792d95cd74780381e1f67a3680dcb6cdede79c114ee2662651093252330d21cb81fa447b2fdbda4b86949b049e3087
SSDEEP

6144:dcLf69bGgexE08A7DsCo5p7zs9xdNWcYRa6stpDgwCOo08cgoZ:dcLy9bGgVwyfsrWc0etpDg1fo

Score

10^/10

isrstealer spyware stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/624-44-0x0000000000400000-0x00000000004B6000-memory.dmp	family_isrstealer
behavioral2/memory/624-46-0x0000000000400000-0x00000000004B6000-memory.dmp	family_isrstealer
behavioral2/memory/624-57-0x0000000000400000-0x00000000004B6000-memory.dmp	family_isrstealer
behavioral2/memory/624-61-0x0000000000400000-0x00000000004B6000-memory.dmp	family_isrstealer

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NTFS ADS 3 IoCs

Processes:

2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe

description	ioc	process
File created	C:\ProgramData\DYA_BFCEGEURPQQTGLRON\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BFP64WVN0JP636PNB0MHN0BG6JTJFSVF7JBCVP4GV	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
File created	C:\Users\Public\Desktop:$SS_DESCRIPTOR_SBXNV9VVGV1BFP64WVN0JP636PNB0MHN0BG6JTJFSVF7JBCVP4GV	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
File created	C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BFP64WVN0JP636PNB0MHN0BG6JTJFSVF7JBCVP4GV	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe

pid	process
624	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
624	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
624	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
624	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
624	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
624	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
624	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
624	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
624	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
624	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
624	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
624	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
624	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
624	2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe

pid process

624 2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2944332d4754e448152c2e5920af3d42_JaffaCakes118.exe"
1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\DYA_BFCEGEURPQQTGLRON\1.0.0\Data\app.dat

Filesize
971B

MD5
00a46c4951748bb8ba002c521bf49d0f

SHA1
91ca9a4c0f856566174346ed430f2336cb294071

SHA256
44da688b19b0b4a3b9a371c7ced0bc64e9717db9a6c1f73fd77baedb78c5e1b3

SHA512
2923513cfd77bea1123bbc2be606abf170d081a0d307fba363b7c0ee09f655aeeb106ad0761f06bee468f583b8c69bf315a3cdec87a3680bbddb228165585aaa

Download Submit
C:\ProgramData\DYA_BFCEGEURPQQTGLRON\1.0.0\Data\updates.dat

Filesize
971B

MD5
dd4dee8168dd8897b915e70b9dc4947e

SHA1
d973178b25a42f13daec574967cb382727342c45

SHA256
b5f50adcecae68b9a266a1fc2f1cb0431e5c01fe7466050f59966c434ab20017

SHA512
1cf8b3efee6895f8b492917bde9883ce947eae64be62c31cff9d0b033d1bb6c0e402dfbf7960ec4c0b300f2ddabacac4d518f11a70a01f06afa7ab7632be858d

Download Submit
C:\Users\Admin\AppData\Roaming\DYA_BFCEGEURPQQTGLRON\1.0.0\Data\dya.dat

Filesize
971B

MD5
c855c079ac83a6a4abe63b2f663f4109

SHA1
bb74e95b0b02c54e7c49ccbd959e541e3a9c6072

SHA256
6b6bf9813ff108163d1680a0964a94e77e9d626e60480c7c3adc41b861a41dac

SHA512
8dcbf79b385fc0befd915248d255b8b83c582cf1828fa3c8019da8feb4797a3452722253b6cc8101715cd880897d459af3bf5fdefee718fb85b30e2d10e540eb

Download Submit
memory/624-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/624-1-0x0000000000413000-0x00000000004B0000-memory.dmp

Filesize
628KB

Download
memory/624-43-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/624-44-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/624-46-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/624-57-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/624-59-0x0000000000413000-0x00000000004B0000-memory.dmp

Filesize
628KB

Download
memory/624-61-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/624-62-0x0000000000413000-0x00000000004B0000-memory.dmp

Filesize
628KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads