isrstealer | 8f95a2a9ae1e0c859cec109b73a7384d117acfcd4da36762a47e6658ddf1ab49

General

Target

e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe
Size

265KB
MD5

e05a1a93cd29737f4bd117d0e786e1bc
SHA1

ab932c26fbbc1b4afa769ca6df09a0cdd55926eb
SHA256

8f95a2a9ae1e0c859cec109b73a7384d117acfcd4da36762a47e6658ddf1ab49
SHA512

6ba947b1393a83c4f6d6c0b72d3b19964b2d2869712ea0193b9f1b191cd0bad0c24e56403b430b3807571730faa4e7dc83200cda4b602704d3d71288e2a6ac28
SSDEEP

6144:rSncRl+TqPRRdIKCC0ef//uXltKc+LVsz9b8:u4LdFeCXuLKcCVsz6

Score

10^/10

isrstealer credential_access discovery spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000001211a-21.dat	family_isrstealer

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Executes dropped EXE 3 IoCs

pid	Process
2568	S.EXE
2688	SR.EXE
2820	S.EXE

Loads dropped DLL 5 IoCs

pid	Process
3032	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe
3032	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe
3032	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe
3032	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe
2568	S.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2820-28-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2820-27-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2820-26-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2820-25-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2820-22-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2820-33-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2568 set thread context of 2820	2568	S.EXE	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SR.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2568	S.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2568	3032	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2568	3032	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2568	3032	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2568	3032	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2688	3032	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe	31
PID 3032 wrote to memory of 2688	3032	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe	31
PID 3032 wrote to memory of 2688	3032	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe	31
PID 3032 wrote to memory of 2688	3032	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe	31
PID 2568 wrote to memory of 2820	2568	S.EXE	32
PID 2568 wrote to memory of 2820	2568	S.EXE	32
PID 2568 wrote to memory of 2820	2568	S.EXE	32
PID 2568 wrote to memory of 2820	2568	S.EXE	32
PID 2568 wrote to memory of 2820	2568	S.EXE	32
PID 2568 wrote to memory of 2820	2568	S.EXE	32
PID 2568 wrote to memory of 2820	2568	S.EXE	32
PID 2568 wrote to memory of 2820	2568	S.EXE	32
PID 2568 wrote to memory of 2820	2568	S.EXE	32

C:\Users\Admin\AppData\Local\Temp\e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\S.EXE
  "C:\Users\Admin\AppData\Local\Temp\S.EXE"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Users\Admin\AppData\Local\Temp\S.EXE
    /scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2820
- C:\Users\Admin\AppData\Local\Temp\SR.EXE
  "C:\Users\Admin\AppData\Local\Temp\SR.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\S.EXE

Filesize
196KB

MD5
cc34c96b6bc094e0f377417b137ef773

SHA1
416bdaf24e42357d9942f1897c927b231b6695cb

SHA256
64025cc74704c387b600d7ebdb3a92aaf19a6b5eb572d8918771b86adad61c2c

SHA512
9c1ac54b86dd23711fe83b5f7f1d4b049e7281586eec99c0cbbb4d69c6e7791f6586457a845a904c7d8b46e1933b3edcc1e306283e8076c2f3a5e6fcbf0a32b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\SR.EXE

Filesize
16KB

MD5
83c2b89c86eafa2410304470ff9ae4fb

SHA1
cbabe9e31b252772dea85b93a2ba95eff6212432

SHA256
4c95d29cbb1c0026d306c84a53ca603e361d942dec3f758b09700bafeb3061fb

SHA512
f517f43cc3823f4ede9466dc3ed7d58fe059acd3fd86fe8d5a604073362fa84f29b1bad43113b081972f9639994ad0b5e931c59baa9a313ec323bd1c859eb85d

Download Submit
memory/2688-34-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2820-28-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2820-27-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2820-26-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2820-25-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2820-22-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2820-33-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing