isrstealer | 84a74f4f38b3387cc309a6c7be50b2e07ea8460020d5fc8112d75227b4b497c3

General

Target

JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe
Size

435KB
MD5

eff7824cf7c1a23477bca1c80a555e84
SHA1

0f1b679a7753a8f84f8408ffe65199580ba49d51
SHA256

84a74f4f38b3387cc309a6c7be50b2e07ea8460020d5fc8112d75227b4b497c3
SHA512

97801f5f205b3292a89241eb49c0e85cf5b593588fe88133f71ba62b814a59d9c3bc550ff6bf9a1f423dd8445d7ebedda9132ef56a1aeb9def66875b0cd67847
SSDEEP

6144:ibxsCQd/nzu7YjOuBh5MtH7UYALAa93dEqUqO4Nra3UI41fbCK2vEd:itsC+/ntKuBhC5lWF9tRjVriJK2

Score

10^/10

isrstealer discovery stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/2952-17-0x0000000000400000-0x0000000000433000-memory.dmp	family_isrstealer
behavioral1/memory/2952-14-0x0000000000400000-0x0000000000433000-memory.dmp	family_isrstealer
behavioral1/memory/2952-26-0x0000000000400000-0x0000000000433000-memory.dmp	family_isrstealer
behavioral1/memory/2952-36-0x0000000000400000-0x0000000000433000-memory.dmp	family_isrstealer

Isrstealer family
isrstealer

Executes dropped EXE 1 IoCs

pid	Process
2836	ExternalCrosshair.exe

Loads dropped DLL 1 IoCs

pid	Process
2736	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 2952	2736	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	31
PID 2952 set thread context of 2576	2952	vbc.exe	32

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2576-27-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2576-31-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2576-30-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2576-28-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2576-34-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExternalCrosshair.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2952	vbc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2836	2736	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	30
PID 2736 wrote to memory of 2836	2736	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	30
PID 2736 wrote to memory of 2836	2736	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	30
PID 2736 wrote to memory of 2836	2736	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	30
PID 2736 wrote to memory of 2952	2736	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	31
PID 2736 wrote to memory of 2952	2736	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	31
PID 2736 wrote to memory of 2952	2736	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	31
PID 2736 wrote to memory of 2952	2736	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	31
PID 2736 wrote to memory of 2952	2736	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	31
PID 2736 wrote to memory of 2952	2736	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	31
PID 2736 wrote to memory of 2952	2736	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	31
PID 2736 wrote to memory of 2952	2736	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	31
PID 2952 wrote to memory of 2576	2952	vbc.exe	32
PID 2952 wrote to memory of 2576	2952	vbc.exe	32
PID 2952 wrote to memory of 2576	2952	vbc.exe	32
PID 2952 wrote to memory of 2576	2952	vbc.exe	32
PID 2952 wrote to memory of 2576	2952	vbc.exe	32
PID 2952 wrote to memory of 2576	2952	vbc.exe	32
PID 2952 wrote to memory of 2576	2952	vbc.exe	32
PID 2952 wrote to memory of 2576	2952	vbc.exe	32
PID 2952 wrote to memory of 2576	2952	vbc.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\ExternalCrosshair.exe
  "C:\Users\Admin\AppData\Local\Temp\ExternalCrosshair.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2836
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ExternalCrosshair.exe

Filesize
110KB

MD5
14bb789601634578053eccbe2e8d336d

SHA1
7e86f9300fe0e1cd23dcf6e8eb19b14eec053b87

SHA256
46ed74667e5cfbc43f5727a9617cd5ca51ec6288e04d59a1571060c6660ad778

SHA512
3b7833315f003070a94aaabe3d55543bae7cc0b7e198cd30d58dd84ae038e2620ac2514b1ac8cdc70a7c350ab8627f304a12b8e41d6cccf8faa83bf1b7266325

Download Submit
memory/2576-27-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2576-34-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2576-28-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2576-30-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2576-31-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2736-1-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2736-2-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2736-0-0x0000000074791000-0x0000000074792000-memory.dmp

Filesize
4KB

Download
memory/2736-29-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2836-21-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2836-24-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2836-19-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2836-35-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2952-23-0x0000000000520000-0x000000000057F000-memory.dmp

Filesize
380KB

Download
memory/2952-10-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2952-26-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2952-12-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2952-14-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2952-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2952-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2952-36-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing