isrstealer | eada68bef32929f9ba47b3f8079bb32e9f9aab10761712d22d3a7fa84d5683f8

General

Target

f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe
Size

507KB
MD5

f12f98156e5d6f72cf3f017cd192896d
SHA1

c6f7225ea26d1c17fc423ce563077bf82f504a21
SHA256

eada68bef32929f9ba47b3f8079bb32e9f9aab10761712d22d3a7fa84d5683f8
SHA512

3495a6b9c5d0529e04c5436ce601c3da80b0530eeb5131e507a0a302e6650b11a6ce41b3a3bbf80bd452b9d9fade83d9879b280c83dd065ec62df173a88d90ed
SSDEEP

12288:PXj4dg6HLm7ZejSvnvPp4LVaKDBPd9O+TozRo:f56HLmFMYnvSZd95ozy

Score

10^/10

isrstealer discovery stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/2828-35-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/2828-33-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral1/memory/2828-41-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Isrstealer family
isrstealer

Executes dropped EXE 2 IoCs

pid	Process
2484	Update.exe
2704	keygen.exe

Loads dropped DLL 9 IoCs

pid	Process
2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe
2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe
2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe
2704	keygen.exe
2704	keygen.exe
2704	keygen.exe
2484	Update.exe
2484	Update.exe
2484	Update.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2484 set thread context of 2828	2484	Update.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2828	vbc.exe
2828	vbc.exe
2828	vbc.exe
2828	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2828	vbc.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2704	2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2704	2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2704	2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2704	2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2704	2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2704	2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2704	2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2484	2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	31
PID 2336 wrote to memory of 2484	2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	31
PID 2336 wrote to memory of 2484	2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	31
PID 2336 wrote to memory of 2484	2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	31
PID 2336 wrote to memory of 2484	2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	31
PID 2336 wrote to memory of 2484	2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	31
PID 2336 wrote to memory of 2484	2336	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2828	2484	Update.exe	32
PID 2484 wrote to memory of 2828	2484	Update.exe	32
PID 2484 wrote to memory of 2828	2484	Update.exe	32
PID 2484 wrote to memory of 2828	2484	Update.exe	32
PID 2484 wrote to memory of 2828	2484	Update.exe	32
PID 2484 wrote to memory of 2828	2484	Update.exe	32
PID 2484 wrote to memory of 2828	2484	Update.exe	32
PID 2484 wrote to memory of 2828	2484	Update.exe	32
PID 2484 wrote to memory of 2828	2484	Update.exe	32
PID 2484 wrote to memory of 2828	2484	Update.exe	32
PID 2484 wrote to memory of 2828	2484	Update.exe	32

C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  "C:\Users\Admin\AppData\Local\Temp\keygen.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2704
- C:\Users\Admin\AppData\Local\Temp\Update.exe
  "C:\Users\Admin\AppData\Local\Temp\Update.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Update.exe

Filesize
215KB

MD5
57c55484129297bd7c28018d68188921

SHA1
8bc8bed5b17eb1c39b211af2672b32c85890d02f

SHA256
fd7a345b66cb1faa6b7cc92ea2f171b939d37b690ee2bdae9edcdb1d58a23651

SHA512
efdfb851f4ed86ef107cf4bb6e2755069107ef6ae4058473e80dca2e763e729dfa5d7a0b1d67bfe1d6911340f3ee8725df42910169ab13239f032d40d476e5d8

Download Submit
\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
414KB

MD5
7104a4e156ec557b1a244248e24e1e11

SHA1
14ad5fe6f1bd048b143680d02952236443d81a5b

SHA256
8d8bd661b6363b13d48dbdd336bdaff9b1bbafd03b7cd24495bb9089d7138e96

SHA512
eed17a4b0864d50b305fe2bd260f97544f05d6fd7e53e9f3e944de379cf4d3821acea9f2e9e56a526537b7a48300b313e01efcefe079e7d28f73e694f7c00008

Download Submit
memory/2336-13-0x0000000002920000-0x0000000002A13000-memory.dmp

Filesize
972KB

Download
memory/2336-10-0x0000000002920000-0x0000000002A13000-memory.dmp

Filesize
972KB

Download
memory/2704-47-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-49-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-27-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-17-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-28-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-29-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-56-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-55-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-54-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-53-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-52-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-51-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-42-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-43-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-44-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-45-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-46-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-30-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-48-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2704-26-0x0000000000260000-0x00000000002AA000-memory.dmp

Filesize
296KB

Download
memory/2704-50-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2828-41-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2828-32-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2828-33-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2828-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2828-35-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2828-31-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing