isrstealer | ebaa7eedd3afaffe68252eab2339114a9915f11e192f9a1f80b0ef74f88d984a

General

Target

ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
Size

142KB
MD5

ae2320bff3232e9fc1ac728c309f8996
SHA1

71ad9e7edc551cd1c55da1150200e0807514b752
SHA256

ebaa7eedd3afaffe68252eab2339114a9915f11e192f9a1f80b0ef74f88d984a
SHA512

93a41a7020fc4fe72d6df8ec53792ad13e4346c916935ba278557c4a6d92f559286e6edef4d5c555f786cd33be47f8630ee7408203641bf3f1a8b5eb25434810
SSDEEP

3072:pWxWYn2UHgK6aWzbAKjjOHXwCvzOvrns3T18wq21uOxhqk:ovH4aWzbRj8yrnGBjuO

Score

10^/10

isrstealer discovery spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4708-8-0x0000000000400000-0x0000000000418000-memory.dmp	family_isrstealer
behavioral2/memory/4708-15-0x0000000000400000-0x0000000000418000-memory.dmp	family_isrstealer

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2000-0-0x0000000000400000-0x0000000000480000-memory.dmp	upx
behavioral2/memory/2000-3-0x0000000000400000-0x0000000000480000-memory.dmp	upx
behavioral2/memory/4708-4-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/4708-6-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/4708-8-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/2000-11-0x0000000000400000-0x0000000000480000-memory.dmp	upx
behavioral2/memory/4708-15-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe

description	pid	process	target process
PID 2000 set thread context of 4708	2000	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exeae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe

pid	process
4708	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
4708	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
4708	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
4708	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
4708	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
4708	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
4708	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
4708	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exeae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe

pid process

2000 ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
4708 ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe

pid	process
2000	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
4708	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe

description	pid	process	target process
PID 2000 wrote to memory of 4708	2000	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
PID 2000 wrote to memory of 4708	2000	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
PID 2000 wrote to memory of 4708	2000	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
PID 2000 wrote to memory of 4708	2000	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
PID 2000 wrote to memory of 4708	2000	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
PID 2000 wrote to memory of 4708	2000	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
PID 2000 wrote to memory of 4708	2000	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
PID 2000 wrote to memory of 4708	2000	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe	ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ae2320bff3232e9fc1ac728c309f8996_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-0-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2000-3-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2000-11-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4708-4-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4708-6-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4708-8-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4708-13-0x0000000000420000-0x00000000004E9000-memory.dmp

Filesize
804KB

Download
memory/4708-15-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads