isrstealer | 3c34b05fb21dc3b7d281c5f528776b695edf7b58f3f84240073c8939f92c2032

General

Target

33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe
Size

255KB
MD5

33a786104d5e3b82458985ccaadea765
SHA1

aa5799c26f8815df3bda581c4415bd92fcfaed5c
SHA256

3c34b05fb21dc3b7d281c5f528776b695edf7b58f3f84240073c8939f92c2032
SHA512

6adf8c52e2eed7427cf5c3a076f1ecd921e6fe055b37629e5d4deac406223dfde75ba8679eccc74146239564ebca9a52cd08488db70cc260431719ca17a450d9
SSDEEP

6144:A+8r3DavvgYgH4howWXXp3u4q/L0PmwlYcGdwsNWd41o:fOOvvgQowqXp30wmw5Gta4

Score

10^/10

isrstealer stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/2648-33-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/2648-29-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/2648-45-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/2648-50-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1188 set thread context of 2760	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	30
PID 1188 set thread context of 2648	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	31

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage	vbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database	vbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset	vbc.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe
1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe
1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe
1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe
1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe
2648	vbc.exe
2648	vbc.exe
2648	vbc.exe
2648	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2648	vbc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2760	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2760	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2760	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2760	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2760	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2760	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2760	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2760	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2760	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2760	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2760	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2760	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2648	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	31
PID 1188 wrote to memory of 2648	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	31
PID 1188 wrote to memory of 2648	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	31
PID 1188 wrote to memory of 2648	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	31
PID 1188 wrote to memory of 2648	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	31
PID 1188 wrote to memory of 2648	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	31
PID 1188 wrote to memory of 2648	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	31
PID 1188 wrote to memory of 2648	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	31
PID 1188 wrote to memory of 2648	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	31
PID 1188 wrote to memory of 2648	1188	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  PID:2760
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1188-1-0x00000000740A0000-0x000000007464B000-memory.dmp

Filesize
5.7MB

Download
memory/1188-2-0x00000000740A0000-0x000000007464B000-memory.dmp

Filesize
5.7MB

Download
memory/1188-0-0x00000000740A1000-0x00000000740A2000-memory.dmp

Filesize
4KB

Download
memory/1188-46-0x00000000740A0000-0x000000007464B000-memory.dmp

Filesize
5.7MB

Download
memory/2648-33-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2648-50-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2648-48-0x0000000000420000-0x00000000004FF000-memory.dmp

Filesize
892KB

Download
memory/2648-45-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2648-25-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2648-27-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2648-29-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2760-22-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2760-44-0x00000000740A0000-0x000000007464B000-memory.dmp

Filesize
5.7MB

Download
memory/2760-41-0x00000000740A0000-0x000000007464B000-memory.dmp

Filesize
5.7MB

Download
memory/2760-13-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2760-43-0x00000000740A0000-0x000000007464B000-memory.dmp

Filesize
5.7MB

Download
memory/2760-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2760-17-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2760-11-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2760-7-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2760-18-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2760-24-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2760-47-0x0000000000280000-0x00000000002C0000-memory.dmp

Filesize
256KB

Download
memory/2760-5-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2760-9-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2760-51-0x00000000740A0000-0x000000007464B000-memory.dmp

Filesize
5.7MB

Download
memory/2760-52-0x0000000000280000-0x00000000002C0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing