isrstealer | 0c985b8539328353fa6e446e25916ed07d25dea1bfa6af32b5db0cea7073d06e

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/10/2026, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-PSW.Win32.Chisburg.ahko.exe
Size 528KB
Sample261010-n7bfhagg55
SHA256 0c985b8539328353fa6e446e25916ed07d25dea1bfa6af32b5db0cea7073d06e
MD5 2237d11e5ae39c91c7bf4b074c9afed2
SHA1 78e0759faafac8c153bfdb629625f7a577314356
SHA512 0f3e08089e612f275d4e7a6b49b2315c86382ee32f3c5e5c082f83cd30aaad736f640d7af5a1f5347dcbc90c6711254e06998f6326a7af41fc0a0c76b1404899
SSDEEP 12288:tHltEXLvtUUfv1pn2lTwT1rBrGtKaSxCesSpgq7F1Ece:tFOaU31piwZrDaSxJbpil
TLSH
T1B2B4231AAB05B623D9F8637B62FE49A41CD26C7F60B005876F87F188257D4B181C8BDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery isrstealer stealer trojan

Malware Config

Signatures

Family: ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/3492-2-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 3492	1828	jaffacakes118_Trojan-PSW.Win32.Chisburg.ahko.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-PSW.Win32.Chisburg.ahko.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1828	jaffacakes118_Trojan-PSW.Win32.Chisburg.ahko.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 3492	1828	jaffacakes118_Trojan-PSW.Win32.Chisburg.ahko.exe	89
PID 1828 wrote to memory of 3492	1828	jaffacakes118_Trojan-PSW.Win32.Chisburg.ahko.exe	89
PID 1828 wrote to memory of 3492	1828	jaffacakes118_Trojan-PSW.Win32.Chisburg.ahko.exe	89
PID 1828 wrote to memory of 3492	1828	jaffacakes118_Trojan-PSW.Win32.Chisburg.ahko.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-PSW.Win32.Chisburg.ahko.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-PSW.Win32.Chisburg.ahko.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-PSW.Win32.Chisburg.ahko.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-PSW.Win32.Chisburg.ahko.exe"
  2⤵
  PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3492-2-0x0000000000400000-0x0000000000442000-memory.dmp

Download