isrstealer | 84a74f4f38b3387cc309a6c7be50b2e07ea8460020d5fc8112d75227b4b497c3

General

Target

JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe
Size

435KB
MD5

eff7824cf7c1a23477bca1c80a555e84
SHA1

0f1b679a7753a8f84f8408ffe65199580ba49d51
SHA256

84a74f4f38b3387cc309a6c7be50b2e07ea8460020d5fc8112d75227b4b497c3
SHA512

97801f5f205b3292a89241eb49c0e85cf5b593588fe88133f71ba62b814a59d9c3bc550ff6bf9a1f423dd8445d7ebedda9132ef56a1aeb9def66875b0cd67847
SSDEEP

6144:ibxsCQd/nzu7YjOuBh5MtH7UYALAa93dEqUqO4Nra3UI41fbCK2vEd:itsC+/ntKuBhC5lWF9tRjVriJK2

Score

10^/10

isrstealer discovery stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/664-14-0x0000000000400000-0x0000000000433000-memory.dmp	family_isrstealer
behavioral2/memory/664-29-0x0000000000400000-0x0000000000433000-memory.dmp	family_isrstealer
behavioral2/memory/664-16-0x0000000000400000-0x0000000000433000-memory.dmp	family_isrstealer
behavioral2/memory/664-38-0x0000000000400000-0x0000000000433000-memory.dmp	family_isrstealer

Isrstealer family
isrstealer

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	3152	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3932017190-1449707826-1445630-1000\Control Panel\International\Geo\Nation	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe

Executes dropped EXE 1 IoCs

pid	Process
3004	ExternalCrosshair.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4608 set thread context of 664	4608	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	87
PID 664 set thread context of 1104	664	vbc.exe	88

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1104-23-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1104-27-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1104-28-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1104-33-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/1104-25-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExternalCrosshair.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1000	MicrosoftEdgeUpdate.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
664	vbc.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 3004	4608	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	86
PID 4608 wrote to memory of 3004	4608	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	86
PID 4608 wrote to memory of 3004	4608	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	86
PID 4608 wrote to memory of 664	4608	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	87
PID 4608 wrote to memory of 664	4608	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	87
PID 4608 wrote to memory of 664	4608	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	87
PID 4608 wrote to memory of 664	4608	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	87
PID 4608 wrote to memory of 664	4608	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	87
PID 4608 wrote to memory of 664	4608	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	87
PID 4608 wrote to memory of 664	4608	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	87
PID 4608 wrote to memory of 664	4608	JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe	87
PID 664 wrote to memory of 1104	664	vbc.exe	88
PID 664 wrote to memory of 1104	664	vbc.exe	88
PID 664 wrote to memory of 1104	664	vbc.exe	88
PID 664 wrote to memory of 1104	664	vbc.exe	88
PID 664 wrote to memory of 1104	664	vbc.exe	88
PID 664 wrote to memory of 1104	664	vbc.exe	88
PID 664 wrote to memory of 1104	664	vbc.exe	88
PID 664 wrote to memory of 1104	664	vbc.exe	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eff7824cf7c1a23477bca1c80a555e84.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\Temp\ExternalCrosshair.exe
  "C:\Users\Admin\AppData\Local\Temp\ExternalCrosshair.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3004
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1104

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDBGNjM0MUMtMzRFQS00MjgyLThEQ0ItMERDN0ExM0MxOTVDfSIgdXNlcmlkPSJ7QzgwMURFQUMtRDgyOC00RkZFLUFCM0EtQUE0Q0VBNDVBQUJDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QkUzOEREMjUtRTRGRS00Qzg2LTlCN0YtMENDMzA1QzNDQUVDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY0MzMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODc1OTU2NTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDk2MTI4MzEwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ExternalCrosshair.exe

Filesize
110KB

MD5
14bb789601634578053eccbe2e8d336d

SHA1
7e86f9300fe0e1cd23dcf6e8eb19b14eec053b87

SHA256
46ed74667e5cfbc43f5727a9617cd5ca51ec6288e04d59a1571060c6660ad778

SHA512
3b7833315f003070a94aaabe3d55543bae7cc0b7e198cd30d58dd84ae038e2620ac2514b1ac8cdc70a7c350ab8627f304a12b8e41d6cccf8faa83bf1b7266325

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
memory/664-38-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/664-14-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/664-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/664-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1104-25-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1104-23-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1104-27-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1104-28-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1104-31-0x0000000000460000-0x0000000000529000-memory.dmp

Filesize
804KB

Download
memory/1104-33-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3004-19-0x0000000074170000-0x0000000074721000-memory.dmp

Filesize
5.7MB

Download
memory/3004-26-0x0000000074170000-0x0000000074721000-memory.dmp

Filesize
5.7MB

Download
memory/3004-17-0x0000000074170000-0x0000000074721000-memory.dmp

Filesize
5.7MB

Download
memory/3004-35-0x0000000001480000-0x0000000001490000-memory.dmp

Filesize
64KB

Download
memory/3004-39-0x0000000074170000-0x0000000074721000-memory.dmp

Filesize
5.7MB

Download
memory/3004-40-0x0000000001480000-0x0000000001490000-memory.dmp

Filesize
64KB

Download
memory/4608-22-0x0000000074170000-0x0000000074721000-memory.dmp

Filesize
5.7MB

Download
memory/4608-0-0x0000000074172000-0x0000000074173000-memory.dmp

Filesize
4KB

Download
memory/4608-2-0x0000000074170000-0x0000000074721000-memory.dmp

Filesize
5.7MB

Download
memory/4608-1-0x0000000074170000-0x0000000074721000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing