isrstealer | eada68bef32929f9ba47b3f8079bb32e9f9aab10761712d22d3a7fa84d5683f8

General

Target

f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe
Size

507KB
MD5

f12f98156e5d6f72cf3f017cd192896d
SHA1

c6f7225ea26d1c17fc423ce563077bf82f504a21
SHA256

eada68bef32929f9ba47b3f8079bb32e9f9aab10761712d22d3a7fa84d5683f8
SHA512

3495a6b9c5d0529e04c5436ce601c3da80b0530eeb5131e507a0a302e6650b11a6ce41b3a3bbf80bd452b9d9fade83d9879b280c83dd065ec62df173a88d90ed
SSDEEP

12288:PXj4dg6HLm7ZejSvnvPp4LVaKDBPd9O+TozRo:f56HLmFMYnvSZd95ozy

Score

10^/10

isrstealer discovery stealer trojan

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 3 IoCs

resource	yara_rule
behavioral2/memory/4940-33-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/4940-36-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer
behavioral2/memory/4940-41-0x0000000000400000-0x0000000000414000-memory.dmp	family_isrstealer

Isrstealer family
isrstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
1572	keygen.exe
1964	Update.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 4940	1964	Update.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4940	vbc.exe
4940	vbc.exe
4940	vbc.exe
4940	vbc.exe
4940	vbc.exe
4940	vbc.exe
4940	vbc.exe
4940	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3932	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3932	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4940	vbc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1572	2116	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	83
PID 2116 wrote to memory of 1572	2116	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	83
PID 2116 wrote to memory of 1572	2116	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	83
PID 2116 wrote to memory of 1964	2116	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	84
PID 2116 wrote to memory of 1964	2116	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	84
PID 2116 wrote to memory of 1964	2116	f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe	84
PID 1964 wrote to memory of 4940	1964	Update.exe	85
PID 1964 wrote to memory of 4940	1964	Update.exe	85
PID 1964 wrote to memory of 4940	1964	Update.exe	85
PID 1964 wrote to memory of 4940	1964	Update.exe	85
PID 1964 wrote to memory of 4940	1964	Update.exe	85
PID 1964 wrote to memory of 4940	1964	Update.exe	85
PID 1964 wrote to memory of 4940	1964	Update.exe	85
PID 1964 wrote to memory of 4940	1964	Update.exe	85

C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  "C:\Users\Admin\AppData\Local\Temp\keygen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1572
- C:\Users\Admin\AppData\Local\Temp\Update.exe
  "C:\Users\Admin\AppData\Local\Temp\Update.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4940

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Update.exe

Filesize
215KB

MD5
57c55484129297bd7c28018d68188921

SHA1
8bc8bed5b17eb1c39b211af2672b32c85890d02f

SHA256
fd7a345b66cb1faa6b7cc92ea2f171b939d37b690ee2bdae9edcdb1d58a23651

SHA512
efdfb851f4ed86ef107cf4bb6e2755069107ef6ae4058473e80dca2e763e729dfa5d7a0b1d67bfe1d6911340f3ee8725df42910169ab13239f032d40d476e5d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
414KB

MD5
7104a4e156ec557b1a244248e24e1e11

SHA1
14ad5fe6f1bd048b143680d02952236443d81a5b

SHA256
8d8bd661b6363b13d48dbdd336bdaff9b1bbafd03b7cd24495bb9089d7138e96

SHA512
eed17a4b0864d50b305fe2bd260f97544f05d6fd7e53e9f3e944de379cf4d3821acea9f2e9e56a526537b7a48300b313e01efcefe079e7d28f73e694f7c00008

Download Submit
memory/1572-53-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-49-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-50-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-56-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-27-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-31-0x00000000007F0000-0x00000000007FC000-memory.dmp

Filesize
48KB

Download
memory/1572-32-0x0000000000401000-0x000000000041B000-memory.dmp

Filesize
104KB

Download
memory/1572-55-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-54-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-28-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-25-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-24-0x0000000000730000-0x000000000077A000-memory.dmp

Filesize
296KB

Download
memory/1572-57-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-20-0x0000000000730000-0x000000000077A000-memory.dmp

Filesize
296KB

Download
memory/1572-44-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-26-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-16-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-52-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-51-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-42-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-43-0x0000000000730000-0x000000000077A000-memory.dmp

Filesize
296KB

Download
memory/1572-29-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/1572-45-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-46-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-47-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-48-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1572-30-0x00000000007D0000-0x00000000007E0000-memory.dmp

Filesize
64KB

Download
memory/1964-39-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/1964-23-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/1964-22-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/1964-21-0x0000000074CB2000-0x0000000074CB3000-memory.dmp

Filesize
4KB

Download
memory/4940-40-0x0000000000420000-0x00000000004E9000-memory.dmp

Filesize
804KB

Download
memory/4940-41-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4940-36-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4940-33-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing