1. When ISIS moves into a city they appropriate everything of value. During their initial expansion they built up quite a war chest, but their expansion has stopped for now so they are not adding funds that way. 2. ISIS makes most of its money by taxing civilians. The oil bombings are targeting the small piece of pie, not the big piece.
Here's my theory: ISIS ran into a classic problem seen by several startup companies. They saw initial success and had fast growth. They wanted to keep growing so they recruited heavily. To recruit a lot of soldiers they promised generous pay and benefits and even offered to support the families of soldiers so dads could go fight. Their burn rate was astronomical, but was okay because they were staying ahead of it through growth. But the growth ended up being unsustainable, because competition arrived and contained them. They kept it up for a long time because they had a lot of funding, but their burn rate finally caught up to them since they haven't been able to keep growing as before. Leadership did not/have not made the transition from wild startup CEOs that give pitch talks and sell to investors into the sensible, sustainable CEOs that manage a company in a saturated market with an eye toward creating a mature company. Remaining in the mode of a wild growth startup company is not an option for these guys. There is no viable strategy for a terrorist group that says "we'll grow like crazy and then sell out to Apple/Facebook/Google/Microsoft while we are popular and they'll handle the maturity stages. Terrorists have to make the maturity transition themselves because they can't be bought out.