isrstealer | 8f95a2a9ae1e0c859cec109b73a7384d117acfcd4da36762a47e6658ddf1ab49

General

Target

e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe
Size

265KB
MD5

e05a1a93cd29737f4bd117d0e786e1bc
SHA1

ab932c26fbbc1b4afa769ca6df09a0cdd55926eb
SHA256

8f95a2a9ae1e0c859cec109b73a7384d117acfcd4da36762a47e6658ddf1ab49
SHA512

6ba947b1393a83c4f6d6c0b72d3b19964b2d2869712ea0193b9f1b191cd0bad0c24e56403b430b3807571730faa4e7dc83200cda4b602704d3d71288e2a6ac28
SSDEEP

6144:rSncRl+TqPRRdIKCC0ef//uXltKc+LVsz9b8:u4LdFeCXuLKcCVsz6

Score

10^/10

isrstealer credential_access discovery spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002347f-4.dat	family_isrstealer

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
1352	S.EXE
4384	SR.EXE
4112	S.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4112-18-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4112-22-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4112-24-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4112-26-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4112-23-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1352 set thread context of 4112	1352	S.EXE	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4748	4384	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SR.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1352	S.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1352	1856	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe	86
PID 1856 wrote to memory of 1352	1856	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe	86
PID 1856 wrote to memory of 1352	1856	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe	86
PID 1856 wrote to memory of 4384	1856	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe	87
PID 1856 wrote to memory of 4384	1856	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe	87
PID 1856 wrote to memory of 4384	1856	e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe	87
PID 1352 wrote to memory of 4112	1352	S.EXE	88
PID 1352 wrote to memory of 4112	1352	S.EXE	88
PID 1352 wrote to memory of 4112	1352	S.EXE	88
PID 1352 wrote to memory of 4112	1352	S.EXE	88
PID 1352 wrote to memory of 4112	1352	S.EXE	88
PID 1352 wrote to memory of 4112	1352	S.EXE	88
PID 1352 wrote to memory of 4112	1352	S.EXE	88
PID 1352 wrote to memory of 4112	1352	S.EXE	88

C:\Users\Admin\AppData\Local\Temp\e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e05a1a93cd29737f4bd117d0e786e1bc_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\S.EXE
  "C:\Users\Admin\AppData\Local\Temp\S.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Users\Admin\AppData\Local\Temp\S.EXE
    /scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4112
- C:\Users\Admin\AppData\Local\Temp\SR.EXE
  "C:\Users\Admin\AppData\Local\Temp\SR.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 536
    3⤵
    - Program crash
    PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4384 -ip 4384
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\S.EXE

Filesize
196KB

MD5
cc34c96b6bc094e0f377417b137ef773

SHA1
416bdaf24e42357d9942f1897c927b231b6695cb

SHA256
64025cc74704c387b600d7ebdb3a92aaf19a6b5eb572d8918771b86adad61c2c

SHA512
9c1ac54b86dd23711fe83b5f7f1d4b049e7281586eec99c0cbbb4d69c6e7791f6586457a845a904c7d8b46e1933b3edcc1e306283e8076c2f3a5e6fcbf0a32b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\SR.EXE

Filesize
16KB

MD5
83c2b89c86eafa2410304470ff9ae4fb

SHA1
cbabe9e31b252772dea85b93a2ba95eff6212432

SHA256
4c95d29cbb1c0026d306c84a53ca603e361d942dec3f758b09700bafeb3061fb

SHA512
f517f43cc3823f4ede9466dc3ed7d58fe059acd3fd86fe8d5a604073362fa84f29b1bad43113b081972f9639994ad0b5e931c59baa9a313ec323bd1c859eb85d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
memory/4112-18-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4112-22-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4112-24-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4112-26-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4112-23-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing