isrstealer | 5bca96912ca868f0136550cb0d7976bfb48dc45065fb8c403e9f2d4e97fd349b

General

Target

2ca2c3d114572d4c688defac3d9d742c_JaffaCakes118.exe
Size

604KB
MD5

2ca2c3d114572d4c688defac3d9d742c
SHA1

b2f457b463b3e5b20bfac3ae39a14002075116e7
SHA256

5bca96912ca868f0136550cb0d7976bfb48dc45065fb8c403e9f2d4e97fd349b
SHA512

41adce55141b55f95e58a54a24dc62b927de7c6274f4a12345796cbc542ad6dfd284480c7683f780a425149529c1b9cb91365d209bd7326113d788e8c738d45b
SSDEEP

12288:i0tCVTnJba1xuyzGgG1TQ9GuXGYRzBXRekpMFT:i0tCNJbae0EFjYRzBXU4MF

Score

10^/10

isrstealer spyware stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3540-27-0x0000000000400000-0x0000000000451000-memory.dmp	family_isrstealer
behavioral2/memory/3540-45-0x0000000000400000-0x0000000000451000-memory.dmp	family_isrstealer
behavioral2/memory/3540-21-0x0000000000400000-0x0000000000451000-memory.dmp	family_isrstealer

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/4684-40-0x0000000000400000-0x0000000000454000-memory.dmp	WebBrowserPassView
behavioral2/memory/4684-42-0x0000000000400000-0x0000000000454000-memory.dmp	WebBrowserPassView
behavioral2/memory/4684-36-0x0000000000400000-0x0000000000454000-memory.dmp	WebBrowserPassView
behavioral2/memory/4684-47-0x0000000000400000-0x0000000000454000-memory.dmp	WebBrowserPassView

Nirsoft 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4684-40-0x0000000000400000-0x0000000000454000-memory.dmp	Nirsoft
behavioral2/memory/4684-42-0x0000000000400000-0x0000000000454000-memory.dmp	Nirsoft
behavioral2/memory/4684-36-0x0000000000400000-0x0000000000454000-memory.dmp	Nirsoft
behavioral2/memory/4684-47-0x0000000000400000-0x0000000000454000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2ca2c3d114572d4c688defac3d9d742c_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Control Panel\International\Geo\Nation	2ca2c3d114572d4c688defac3d9d742c_JaffaCakes118.exe

Executes dropped EXE 4 IoCs

Processes:

ЏЎЗѤѠ.execvtres.execvtres.execvtres.exe

pid process

1828 ЏЎЗѤѠ.exe
3540 cvtres.exe
3636 cvtres.exe
4684 cvtres.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1828	ЏЎЗѤѠ.exe
3540	cvtres.exe
3636	cvtres.exe
4684	cvtres.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ЏЎЗѤѠ.execvtres.execvtres.exe

description	pid	process	target process
PID 1828 set thread context of 3540	1828	ЏЎЗѤѠ.exe	cvtres.exe
PID 3540 set thread context of 3636	3540	cvtres.exe	cvtres.exe
PID 3636 set thread context of 4684	3636	cvtres.exe	cvtres.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

cvtres.exe

pid process

3540 cvtres.exe
3540 cvtres.exe
3540 cvtres.exe
3540 cvtres.exe
3540 cvtres.exe
3540 cvtres.exe
3540 cvtres.exe
3540 cvtres.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cvtres.exe

pid process

3540 cvtres.exe

pid	process
3540	cvtres.exe
3540	cvtres.exe
3540	cvtres.exe
3540	cvtres.exe
3540	cvtres.exe
3540	cvtres.exe
3540	cvtres.exe
3540	cvtres.exe

pid	process
3540	cvtres.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

2ca2c3d114572d4c688defac3d9d742c_JaffaCakes118.exeЏЎЗѤѠ.execvtres.execvtres.exe

description	pid	process	target process
PID 1704 wrote to memory of 1828	1704	2ca2c3d114572d4c688defac3d9d742c_JaffaCakes118.exe	ЏЎЗѤѠ.exe
PID 1704 wrote to memory of 1828	1704	2ca2c3d114572d4c688defac3d9d742c_JaffaCakes118.exe	ЏЎЗѤѠ.exe
PID 1704 wrote to memory of 1828	1704	2ca2c3d114572d4c688defac3d9d742c_JaffaCakes118.exe	ЏЎЗѤѠ.exe
PID 1828 wrote to memory of 3540	1828	ЏЎЗѤѠ.exe	cvtres.exe
PID 1828 wrote to memory of 3540	1828	ЏЎЗѤѠ.exe	cvtres.exe
PID 1828 wrote to memory of 3540	1828	ЏЎЗѤѠ.exe	cvtres.exe
PID 1828 wrote to memory of 3540	1828	ЏЎЗѤѠ.exe	cvtres.exe
PID 1828 wrote to memory of 3540	1828	ЏЎЗѤѠ.exe	cvtres.exe
PID 1828 wrote to memory of 3540	1828	ЏЎЗѤѠ.exe	cvtres.exe
PID 1828 wrote to memory of 3540	1828	ЏЎЗѤѠ.exe	cvtres.exe
PID 1828 wrote to memory of 3540	1828	ЏЎЗѤѠ.exe	cvtres.exe
PID 3540 wrote to memory of 3636	3540	cvtres.exe	cvtres.exe
PID 3540 wrote to memory of 3636	3540	cvtres.exe	cvtres.exe
PID 3540 wrote to memory of 3636	3540	cvtres.exe	cvtres.exe
PID 3540 wrote to memory of 3636	3540	cvtres.exe	cvtres.exe
PID 3540 wrote to memory of 3636	3540	cvtres.exe	cvtres.exe
PID 3540 wrote to memory of 3636	3540	cvtres.exe	cvtres.exe
PID 3540 wrote to memory of 3636	3540	cvtres.exe	cvtres.exe
PID 3540 wrote to memory of 3636	3540	cvtres.exe	cvtres.exe
PID 3540 wrote to memory of 3636	3540	cvtres.exe	cvtres.exe
PID 3540 wrote to memory of 3636	3540	cvtres.exe	cvtres.exe
PID 3540 wrote to memory of 3636	3540	cvtres.exe	cvtres.exe
PID 3540 wrote to memory of 3636	3540	cvtres.exe	cvtres.exe
PID 3540 wrote to memory of 3636	3540	cvtres.exe	cvtres.exe
PID 3636 wrote to memory of 4684	3636	cvtres.exe	cvtres.exe
PID 3636 wrote to memory of 4684	3636	cvtres.exe	cvtres.exe
PID 3636 wrote to memory of 4684	3636	cvtres.exe	cvtres.exe
PID 3636 wrote to memory of 4684	3636	cvtres.exe	cvtres.exe
PID 3636 wrote to memory of 4684	3636	cvtres.exe	cvtres.exe

C:\Users\Admin\AppData\Local\Temp\2ca2c3d114572d4c688defac3d9d742c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2ca2c3d114572d4c688defac3d9d742c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\ЏЎЗѤѠ.exe
  "C:\Users\Admin\AppData\Local\Temp\ЏЎЗѤѠ.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Users\Admin\AppData\Local\Temp\cvtres.exe
    C:\Users\Admin\AppData\Local\Temp\cvtres.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\cvtres.exe
      "C:\Users\Admin\AppData\Local\Temp\cvtres.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\cvtres.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cvtres.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data.dmp
        5⤵
        Executes dropped EXE
        
        PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cvtres.exe

Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ЏЎЗѤѠ.exe

Filesize
396KB

MD5
1484507647d2cbec4cb99cba142c0cc7

SHA1
a5524049d49cf6e1c80edec32d856f88a482c9b5

SHA256
04f1e7d8d2341a05631c1e796aa077fdba25503fcd41ff2f869b0f064024e33c

SHA512
d764d63635fbe46a24e774dbf9cdddbcccb78056afaa357f6d1293a8ba2d5cb29eb085956fa412c48f721c28424a7569f7829d097fc0dbc0ee7b840cc1c484c7

Download Submit
memory/1704-0-0x0000000074DF2000-0x0000000074DF3000-memory.dmp

Filesize
4KB

Download
memory/1704-1-0x0000000074DF0000-0x00000000753A1000-memory.dmp

Filesize
5.7MB

Download
memory/1704-2-0x0000000074DF0000-0x00000000753A1000-memory.dmp

Filesize
5.7MB

Download
memory/1704-15-0x0000000074DF0000-0x00000000753A1000-memory.dmp

Filesize
5.7MB

Download
memory/1828-16-0x0000000074DF0000-0x00000000753A1000-memory.dmp

Filesize
5.7MB

Download
memory/1828-17-0x0000000074DF0000-0x00000000753A1000-memory.dmp

Filesize
5.7MB

Download
memory/1828-18-0x0000000074DF0000-0x00000000753A1000-memory.dmp

Filesize
5.7MB

Download
memory/1828-28-0x0000000074DF0000-0x00000000753A1000-memory.dmp

Filesize
5.7MB

Download
memory/3540-27-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3540-45-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3540-21-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3636-31-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3636-34-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3636-37-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3636-35-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3636-33-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4684-40-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4684-42-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4684-36-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4684-47-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads