isrstealer | 3c34b05fb21dc3b7d281c5f528776b695edf7b58f3f84240073c8939f92c2032

General

Target

33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe
Size

255KB
MD5

33a786104d5e3b82458985ccaadea765
SHA1

aa5799c26f8815df3bda581c4415bd92fcfaed5c
SHA256

3c34b05fb21dc3b7d281c5f528776b695edf7b58f3f84240073c8939f92c2032
SHA512

6adf8c52e2eed7427cf5c3a076f1ecd921e6fe055b37629e5d4deac406223dfde75ba8679eccc74146239564ebca9a52cd08488db70cc260431719ca17a450d9
SSDEEP

6144:A+8r3DavvgYgH4howWXXp3u4q/L0PmwlYcGdwsNWd41o:fOOvvgQowqXp30wmw5Gta4

Score

10^/10

isrstealer stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/1192-6-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/1192-8-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/1192-16-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/1192-19-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/2276-23-0x00000000005D0000-0x00000000005E0000-memory.dmp	family_isrstealer

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3928 set thread context of 2276	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	84
PID 3928 set thread context of 1192	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	85

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\MIME\Database	vbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset	vbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage	vbc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe
3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe
3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe
3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe
3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe
1192	vbc.exe
1192	vbc.exe
1192	vbc.exe
1192	vbc.exe
1192	vbc.exe
1192	vbc.exe
1192	vbc.exe
1192	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1192	vbc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 2276	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	84
PID 3928 wrote to memory of 2276	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	84
PID 3928 wrote to memory of 2276	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	84
PID 3928 wrote to memory of 2276	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	84
PID 3928 wrote to memory of 2276	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	84
PID 3928 wrote to memory of 2276	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	84
PID 3928 wrote to memory of 2276	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	84
PID 3928 wrote to memory of 2276	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	84
PID 3928 wrote to memory of 2276	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	84
PID 3928 wrote to memory of 2276	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	84
PID 3928 wrote to memory of 2276	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	84
PID 3928 wrote to memory of 1192	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	85
PID 3928 wrote to memory of 1192	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	85
PID 3928 wrote to memory of 1192	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	85
PID 3928 wrote to memory of 1192	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	85
PID 3928 wrote to memory of 1192	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	85
PID 3928 wrote to memory of 1192	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	85
PID 3928 wrote to memory of 1192	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	85
PID 3928 wrote to memory of 1192	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	85
PID 3928 wrote to memory of 1192	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	85
PID 3928 wrote to memory of 1192	3928	33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\33a786104d5e3b82458985ccaadea765_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  PID:2276
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-19-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1192-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1192-16-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1192-17-0x0000000000420000-0x00000000004E9000-memory.dmp

Filesize
804KB

Download
memory/1192-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2276-20-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/2276-9-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/2276-24-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/2276-5-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2276-13-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/2276-21-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/2276-22-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/2276-23-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/2276-15-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/3928-14-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/3928-2-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/3928-0-0x0000000075482000-0x0000000075483000-memory.dmp

Filesize
4KB

Download
memory/3928-1-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing