stealerium | 1d854d717ddb81b7553ca4b656abff486e9c9b88f00bb5c7c32439f0f0ec4a75

Analysis

max time kernel
77s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2023, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DiscordUpdater.exe
Size 2.3MB
Sample230402-t25eaaaf7w
SHA256 1d854d717ddb81b7553ca4b656abff486e9c9b88f00bb5c7c32439f0f0ec4a75
MD5 d2829d67c58fbacd09f8d0a23451fc30
SHA1 273ecdd5b7dd155356acd6bc56e718cdf1ebb537
SHA512 a6965217bf6c2f583cd01cb2dfe8b13c4a6ac74d36a92a916ad6bc383aeac0b06d172217f545fb519e231bce738ab138da6c3bd6726037756d1be9fda5fa3900
SSDEEP 49152:JrZblZvo10fSJtySnq1xKa84rJDWBHUu5G060Q:JdHo2fUEo6tf9bu/60Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealerium collection spyware stealer

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/1083787486414770176/bRUby2Hc780n1rWbdH1JvR9FMQhXsGjeB4IDRJlA2ejLhOoyL0sbMZ8pBlrnhljoFEKB

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	icanhazip.com
16	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3896 set thread context of 1940	3896	DiscordUpdater.exe	79

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegAsm.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4804	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3456	taskkill.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe
1940	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	RegAsm.exe
Token: SeSecurityPrivilege	4284	msiexec.exe
Token: SeDebugPrivilege	3456	taskkill.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 1940	3896	DiscordUpdater.exe	79
PID 3896 wrote to memory of 1940	3896	DiscordUpdater.exe	79
PID 3896 wrote to memory of 1940	3896	DiscordUpdater.exe	79
PID 3896 wrote to memory of 1940	3896	DiscordUpdater.exe	79
PID 3896 wrote to memory of 1940	3896	DiscordUpdater.exe	79
PID 3896 wrote to memory of 1940	3896	DiscordUpdater.exe	79
PID 3896 wrote to memory of 1940	3896	DiscordUpdater.exe	79
PID 3896 wrote to memory of 1940	3896	DiscordUpdater.exe	79
PID 1940 wrote to memory of 2672	1940	RegAsm.exe	82
PID 1940 wrote to memory of 2672	1940	RegAsm.exe	82
PID 1940 wrote to memory of 2672	1940	RegAsm.exe	82
PID 2672 wrote to memory of 4780	2672	cmd.exe	85
PID 2672 wrote to memory of 4780	2672	cmd.exe	85
PID 2672 wrote to memory of 4780	2672	cmd.exe	85
PID 2672 wrote to memory of 4808	2672	cmd.exe	86
PID 2672 wrote to memory of 4808	2672	cmd.exe	86
PID 2672 wrote to memory of 4808	2672	cmd.exe	86
PID 2672 wrote to memory of 436	2672	cmd.exe	87
PID 2672 wrote to memory of 436	2672	cmd.exe	87
PID 2672 wrote to memory of 436	2672	cmd.exe	87
PID 1940 wrote to memory of 4480	1940	RegAsm.exe	90
PID 1940 wrote to memory of 4480	1940	RegAsm.exe	90
PID 1940 wrote to memory of 4480	1940	RegAsm.exe	90
PID 4480 wrote to memory of 4804	4480	cmd.exe	92
PID 4480 wrote to memory of 4804	4480	cmd.exe	92
PID 4480 wrote to memory of 4804	4480	cmd.exe	92
PID 4480 wrote to memory of 2700	4480	cmd.exe	93
PID 4480 wrote to memory of 2700	4480	cmd.exe	93
PID 4480 wrote to memory of 2700	4480	cmd.exe	93
PID 1940 wrote to memory of 2240	1940	RegAsm.exe	100
PID 1940 wrote to memory of 2240	1940	RegAsm.exe	100
PID 1940 wrote to memory of 2240	1940	RegAsm.exe	100
PID 2240 wrote to memory of 436	2240	cmd.exe	103
PID 2240 wrote to memory of 436	2240	cmd.exe	103
PID 2240 wrote to memory of 436	2240	cmd.exe	103
PID 2240 wrote to memory of 3456	2240	cmd.exe	104
PID 2240 wrote to memory of 3456	2240	cmd.exe	104
PID 2240 wrote to memory of 3456	2240	cmd.exe	104
PID 2240 wrote to memory of 4804	2240	cmd.exe	105
PID 2240 wrote to memory of 4804	2240	cmd.exe	105
PID 2240 wrote to memory of 4804	2240	cmd.exe	105

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordUpdater.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Checks computer location settings
  - Accesses Microsoft Outlook profiles
  - Drops file in Windows directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:4780
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      PID:4808
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      PID:436
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:4804
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      PID:2700
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp6BF.tmp.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:436
  - - C:\Windows\SysWOW64\taskkill.exe
      TaskKill /F /IM 1940
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3456
  - - C:\Windows\SysWOW64\timeout.exe
      Timeout /T 2 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4804

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\12289d124294e297e9d3ee79375fe871\Admin@ROBKQPFG_en-US\Browsers\Firefox\Bookmarks.txt
Size 105B
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
MD5 SHA1 SHA512

Submit Download

OneDrive.txt

Path C:\Users\Admin\AppData\Local\12289d124294e297e9d3ee79375fe871\Admin@ROBKQPFG_en-US\Directories\OneDrive.txt
Size 25B
SHA256 8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
MD5 966247eb3ee749e21597d73c4176bd52
SHA1 1e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA512 bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
MD5 SHA1 SHA512

Submit Download

Startup.txt

Path C:\Users\Admin\AppData\Local\12289d124294e297e9d3ee79375fe871\Admin@ROBKQPFG_en-US\Directories\Startup.txt
Size 24B
SHA256 889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
MD5 68c93da4981d591704cea7b71cebfb97
SHA1 fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA512 63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
MD5 SHA1 SHA512

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\12289d124294e297e9d3ee79375fe871\Admin@ROBKQPFG_en-US\Directories\Videos.txt
Size 23B
SHA256 a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
MD5 1fddbf1169b6c75898b86e7e24bc7c1f
SHA1 d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA512 20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
MD5 SHA1 SHA512

Submit Download

Apps.txt

Path C:\Users\Admin\AppData\Local\12289d124294e297e9d3ee79375fe871\Admin@ROBKQPFG_en-US\System\Apps.txt
Size 4KB
SHA256 34521e6d0198b51feb4d45dabea3cbfe831ad85e8d9ab217446f4f32c4a7416a
MD5 478dda4fd6ee0d5f21173be05dc49cc4
SHA1 baa5f4736bb736ceb6808e8529d66013b2216993
SHA512 42d7a8912e5f3ffc47edea69b4bdddaa4978428dcfd070ba00c1a44f31a09c588d3212d187246a57450ef61a1de6ce510f3404983cd087dec0ba2f4ad5706a85
SSDEEP 96:OfpCX3fpCXPfpCmNpJfVQWEfvpKEfvDvufVi2f6Dr82f6TRpqffutrhffuS08coi:wpC/pC3pCsVn2vw2vEVi46Dr8466uLuX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Debug.txt

Path C:\Users\Admin\AppData\Local\12289d124294e297e9d3ee79375fe871\Admin@ROBKQPFG_en-US\System\Debug.txt
Size 332B
SHA256 35769424fa96484c36c78eefc8aeb6267437dd20a65afdcfa909b3eca08ae856
MD5 ea8d603f16a2bfbe008564b2ee6beb06
SHA1 6f9ae94965947733cea4693257c0064116a81ae8
SHA512 6527574daba809c12098dab7ebf8e4316c4ae424f0dc50b26533eeda4e88724121e6eefc4c1c0abe49e1215014f885cf806a1c487d9a4a17274e5c596d356b0a
MD5 SHA1 SHA512

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\12289d124294e297e9d3ee79375fe871\Admin@ROBKQPFG_en-US\System\Process.txt
Size 4KB
SHA256 b1b091024e3863e54eccd9edf7ec434e91be6b12218ba7c67b6fdd6c81f34e65
MD5 479224ea7cea5a2db032a7757f510f70
SHA1 f671b25576a980e05e4f5f12b17d9ebcec93293f
SHA512 863f6b953dad5f91d6882d2a2e29c72e3183e4e8ba569ef1fd06b995cbbde254495d564ee596f967d979780fa1fc0a0ffd500ee379d7a2e121efbd4ced94c729
SSDEEP 48:psEcPsItLxz8FNGibcgJjb1uP2o23OY/2JPQwTa5:pURJ8NzwMjBU2o23v/2JPQwTa5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProductKey.txt

Path C:\Users\Admin\AppData\Local\12289d124294e297e9d3ee79375fe871\Admin@ROBKQPFG_en-US\System\ProductKey.txt
Size 29B
SHA256 f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
MD5 71eb5479298c7afc6d126fa04d2a9bde
SHA1 a9b3d5505cf9f84bb6c2be2acece53cb40075113
SHA512 7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd
MD5 SHA1 SHA512

Submit Download

msgid.dat

Path C:\Users\Admin\AppData\Local\12289d124294e297e9d3ee79375fe871\msgid.dat
Size 19B
SHA256 eb51d0ca038379d8e2550080c8f691a57271f69eb192f0fd7021b438bf14840e
MD5 28c238e9f308dea1b0b5cb80ac18167a
SHA1 a5c0193b274e8b24ed9c394051fa11ac97a665c2
SHA512 7e508a89af3a84e4f6da836fc09993a7600b4445318942f044e844c46837b2c2d169dd0eed18be72269704f42ea64ab78415dd7a2c66db7ce4d71684d56bb434
MD5 SHA1 SHA512

Submit Download

tmp6BF.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp6BF.tmp.bat
Size 57B
SHA256 e337b9ffdd3ce0ee7d52dd379b5a83335f030b1e965d3e10a0230cffc1e6d1be
MD5 e480af4fe95a4e56acedfdb80a8dcc0c
SHA1 86c376691e515080fd4b02694ded267401be3546
SHA512 9cd78e5357af2e04c54207af09422315fb0699069b291b1d48595f2530bdead40c5d4451c97474a6d22aec043874ae2ffd90fca4900fe036bdd5999b381b7d68
MD5 SHA1 SHA512

Submit Download

memory/1940-141-0x0000000005600000-0x0000000005610000-memory.dmp

Download

memory/1940-296-0x0000000005600000-0x0000000005610000-memory.dmp

Download

memory/1940-189-0x0000000007490000-0x0000000007A34000-memory.dmp

Download

memory/1940-183-0x0000000006E40000-0x0000000006ED2000-memory.dmp

Download

memory/1940-137-0x0000000005600000-0x0000000005610000-memory.dmp

Download

memory/1940-365-0x0000000006450000-0x0000000006472000-memory.dmp

Download

memory/1940-136-0x0000000005320000-0x0000000005386000-memory.dmp

Download

memory/1940-134-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/3896-133-0x0000000000E90000-0x00000000010E2000-memory.dmp

Download