isrstealer | 183de1052efc79d111da426e80685ba561042c7e3d3d86ec97efec66a0e4205b

Analysis

max time kernel
21s
max time network
19s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4094058047f8effdacd903a2151add4d_JaffaCakes118.exe
Size

348KB
MD5

4094058047f8effdacd903a2151add4d
SHA1

dabe91c6dadf979752cf6932d6ee3648f7385046
SHA256

183de1052efc79d111da426e80685ba561042c7e3d3d86ec97efec66a0e4205b
SHA512

9a6e4b74cc0dcbbc9857f62ac2876a8d327754404cf09ddb7737ebf87edbfb3d4e740e4b20090afe1aeeb304398780f7fe450133f43936db0d22b924c0030979
SSDEEP

3072:8h+TCYEODORUGmMgOvON8lm4doscIGw0LxWDdCxkknIeQ13UYcbKDmVywyLXKao8:sI8sKiw0M13UdmmVyr6jnE

Score

10^/10

isrstealer stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1488-5-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1488-8-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1488-14-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/1488-17-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

4094058047f8effdacd903a2151add4d_JaffaCakes118.exe

description pid process target process

PID 2876 set thread context of 1488 2876 4094058047f8effdacd903a2151add4d_JaffaCakes118.exe vbc.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

vbc.exe

pid process

1488 vbc.exe
1488 vbc.exe
1488 vbc.exe
1488 vbc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

1488 vbc.exe

description	pid	process	target process
PID 2876 set thread context of 1488	2876	4094058047f8effdacd903a2151add4d_JaffaCakes118.exe	vbc.exe

pid	process
1488	vbc.exe
1488	vbc.exe
1488	vbc.exe
1488	vbc.exe

pid	process
1488	vbc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4094058047f8effdacd903a2151add4d_JaffaCakes118.exe

description	pid	process	target process
PID 2876 wrote to memory of 1488	2876	4094058047f8effdacd903a2151add4d_JaffaCakes118.exe	vbc.exe
PID 2876 wrote to memory of 1488	2876	4094058047f8effdacd903a2151add4d_JaffaCakes118.exe	vbc.exe
PID 2876 wrote to memory of 1488	2876	4094058047f8effdacd903a2151add4d_JaffaCakes118.exe	vbc.exe
PID 2876 wrote to memory of 1488	2876	4094058047f8effdacd903a2151add4d_JaffaCakes118.exe	vbc.exe
PID 2876 wrote to memory of 1488	2876	4094058047f8effdacd903a2151add4d_JaffaCakes118.exe	vbc.exe
PID 2876 wrote to memory of 1488	2876	4094058047f8effdacd903a2151add4d_JaffaCakes118.exe	vbc.exe
PID 2876 wrote to memory of 1488	2876	4094058047f8effdacd903a2151add4d_JaffaCakes118.exe	vbc.exe
PID 2876 wrote to memory of 1488	2876	4094058047f8effdacd903a2151add4d_JaffaCakes118.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\4094058047f8effdacd903a2151add4d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4094058047f8effdacd903a2151add4d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1488-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1488-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1488-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1488-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1488-14-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1488-17-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2876-0-0x0000000074A91000-0x0000000074A92000-memory.dmp

Filesize
4KB

Download
memory/2876-1-0x0000000074A90000-0x000000007503B000-memory.dmp

Filesize
5.7MB

Download
memory/2876-2-0x0000000074A90000-0x000000007503B000-memory.dmp

Filesize
5.7MB

Download
memory/2876-12-0x0000000074A90000-0x000000007503B000-memory.dmp

Filesize
5.7MB

Download