stealerium | 9cc27672a2e00c8d80aabd4864e94a8c9e8ad43b41766f7ff4fc3a86156ae842

Analysis

max time kernel
25s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2023, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NitroSniper.exe
Size 1.6MB
Sample230423-11d92agb96
SHA256 9cc27672a2e00c8d80aabd4864e94a8c9e8ad43b41766f7ff4fc3a86156ae842
MD5 5b81a9494933dffdbd7202d7f0a590ea
SHA1 d4b5d99bf0713adee5adf8ccc970ba43b11a597c
SHA512 d9ad0b530ce8af82f43db24860b2837d792b0f8ee386d04ece4881f028b6471919947e31a43dc98a83c22cfc438edeb63d980aec11029e07e31c1de812fc3680
SSDEEP 24576:MSOi2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgLX:FTq24GjdGSiqkqXfd+/9AqYanieKd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealerium collection spyware stealer

Malware Config

Extracted

Family

stealerium

https://discordapp.com/api/webhooks/1099818116013375569/ni2fQxM0615aahQ27dB8Yh6FaugvCLHwCUGYP-1mCfammGHxLaBAmyfk9_huHQMAhHk8

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NitroSniper.exe
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NitroSniper.exe
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NitroSniper.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	icanhazip.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	NitroSniper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	NitroSniper.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
4028	NitroSniper.exe
2460	mspaint.exe
2460	mspaint.exe
4028	NitroSniper.exe
4028	NitroSniper.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	NitroSniper.exe
Token: SeSecurityPrivilege	2064	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2460	mspaint.exe
2460	mspaint.exe
2460	mspaint.exe
2460	mspaint.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 724	4028	NitroSniper.exe	90
PID 4028 wrote to memory of 724	4028	NitroSniper.exe	90
PID 4028 wrote to memory of 724	4028	NitroSniper.exe	90
PID 724 wrote to memory of 4456	724	cmd.exe	93
PID 724 wrote to memory of 4456	724	cmd.exe	93
PID 724 wrote to memory of 4456	724	cmd.exe	93
PID 724 wrote to memory of 924	724	cmd.exe	94
PID 724 wrote to memory of 924	724	cmd.exe	94
PID 724 wrote to memory of 924	724	cmd.exe	94
PID 724 wrote to memory of 1184	724	cmd.exe	95
PID 724 wrote to memory of 1184	724	cmd.exe	95
PID 724 wrote to memory of 1184	724	cmd.exe	95
PID 4028 wrote to memory of 4852	4028	NitroSniper.exe	98
PID 4028 wrote to memory of 4852	4028	NitroSniper.exe	98
PID 4028 wrote to memory of 4852	4028	NitroSniper.exe	98
PID 4852 wrote to memory of 1236	4852	cmd.exe	100
PID 4852 wrote to memory of 1236	4852	cmd.exe	100
PID 4852 wrote to memory of 1236	4852	cmd.exe	100
PID 4852 wrote to memory of 1800	4852	cmd.exe	101
PID 4852 wrote to memory of 1800	4852	cmd.exe	101
PID 4852 wrote to memory of 1800	4852	cmd.exe	101

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NitroSniper.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	NitroSniper.exe

C:\Users\Admin\AppData\Local\Temp\NitroSniper.exe
"C:\Users\Admin\AppData\Local\Temp\NitroSniper.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:724
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:4456
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profile
    3⤵
    PID:924
- - C:\Windows\SysWOW64\findstr.exe
    findstr All
    3⤵
    PID:1184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:1236
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    PID:1800

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\EnterHide.rle"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4744

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\Desktop\AddShow.pptm" /ou ""
1⤵
PID:1372

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UpdateProtect.MTS"
1⤵
PID:1188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\3670db5c65827802f3a0d0652a910ec5\Admin@TLGENAJY_en-US\Browsers\Firefox\Bookmarks.txt
Size 105B
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
MD5 SHA1 SHA512

Submit Download

OneDrive.txt

Path C:\Users\Admin\AppData\Local\3670db5c65827802f3a0d0652a910ec5\Admin@TLGENAJY_en-US\Directories\OneDrive.txt
Size 25B
SHA256 8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
MD5 966247eb3ee749e21597d73c4176bd52
SHA1 1e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA512 bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
MD5 SHA1 SHA512

Submit Download

Startup.txt

Path C:\Users\Admin\AppData\Local\3670db5c65827802f3a0d0652a910ec5\Admin@TLGENAJY_en-US\Directories\Startup.txt
Size 24B
SHA256 889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
MD5 68c93da4981d591704cea7b71cebfb97
SHA1 fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA512 63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
MD5 SHA1 SHA512

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\3670db5c65827802f3a0d0652a910ec5\Admin@TLGENAJY_en-US\Directories\Videos.txt
Size 23B
SHA256 a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
MD5 1fddbf1169b6c75898b86e7e24bc7c1f
SHA1 d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA512 20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
MD5 SHA1 SHA512

Submit Download

Apps.txt

Path C:\Users\Admin\AppData\Local\3670db5c65827802f3a0d0652a910ec5\Admin@TLGENAJY_en-US\System\Apps.txt
Size 4KB
SHA256 35ea18d09bb3ab1204c8dfe9b3071b089e2aa72bcac1ef514b56b35eb2f04a69
MD5 84d49cd421c0443c00345ed77f2ee934
SHA1 3df608dd93a668f734a98505b82a0e7a866af458
SHA512 92e2c8c7b0b0ca4dd3af82cbbff5653e87152f2e3dbbf6f5e3f0126861fe9f7aab03b5dc58ca8311016dd01c649544f4b415b9fe906e10fcdc35e5dfe4edf4e0
SSDEEP 96:Ofp3X3fp3XPfp3mNpJfwQWEf6pKEf6Dvufwi2fPDr82fPTRpqffDtrhffDS08coK:wp3/p33p3swn26w26Ewi4PDr84P6DLDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Debug.txt

Path C:\Users\Admin\AppData\Local\3670db5c65827802f3a0d0652a910ec5\Admin@TLGENAJY_en-US\System\Debug.txt
Size 1KB
SHA256 fd1a5348f1643feb69829df1b774442fb25d8a64adf9ac7e5266b4d97da377a6
MD5 49b9b0ca5a535d47e88c6710ee1c1790
SHA1 d51d8cf3492655f5b10cb8ccab267bbf35f2fe90
SHA512 75e580f2bd672ae0704076abc189ca300299ef28830f2fe5c0f5e2c42c38b4493d0c227afbfb06b2f5bc23a111dae864213df86510e9110e652516d2c57a023c
MD5 SHA1 SHA512

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\3670db5c65827802f3a0d0652a910ec5\Admin@TLGENAJY_en-US\System\Process.txt
Size 4KB
SHA256 5bcaf902131b8e0761ae21e6455da801b34d5171d8b5acf7ee0c12208e374362
MD5 8191370b0a55e1cbb57f866e4c586df0
SHA1 0b1b338fbf7ed1064343a284fe83733fbfd7bb62
SHA512 356a3bca6b81cfb05f4b19b9b01af23d17131bc9f704536dbdf090cadea59599157e47bc721725f59ea4a504ad61405c3aa93471624cd595977b96866582f3d6
SSDEEP 48:PCztM2NkoOIUgfb32NwC5w3VJb1uuHbc7:AtM2NkoOufb3yf5w33BVHw7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProductKey.txt

Path C:\Users\Admin\AppData\Local\3670db5c65827802f3a0d0652a910ec5\Admin@TLGENAJY_en-US\System\ProductKey.txt
Size 29B
SHA256 f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
MD5 71eb5479298c7afc6d126fa04d2a9bde
SHA1 a9b3d5505cf9f84bb6c2be2acece53cb40075113
SHA512 7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd
MD5 SHA1 SHA512

Submit Download

msgid.dat

Path C:\Users\Admin\AppData\Local\3670db5c65827802f3a0d0652a910ec5\msgid.dat
Size 19B
SHA256 61bc9fce427ed0dd8d4d62eea12ee59675fb8cb75b3c9fd034578dd75edae949
MD5 8b725b36b0169fbb6e5ef35c973b0b69
SHA1 00ae0b58557d1444cc26cb8a238e2868186235d0
SHA512 e88dd6d9b932c7060db1f6e515a4df09fd498f4ddd74990d6408a11b4e4247e4db4586bd3a2832a640e644aa18e995aa1044da84405307a37a29da1a54dae215
MD5 SHA1 SHA512

Submit Download

memory/1188-440-0x00007FFF9BBA0000-0x00007FFF9BCB2000-memory.dmp

Download

memory/1188-439-0x00000239A3F70000-0x00000239A501B000-memory.dmp

Download

memory/1188-438-0x00007FFF9E180000-0x00007FFF9E434000-memory.dmp

Download

memory/1188-437-0x00007FFF9F500000-0x00007FFF9F534000-memory.dmp

Download

memory/1188-436-0x00007FF6BC5F0000-0x00007FF6BC6E8000-memory.dmp

Download

memory/1372-399-0x00007FFF7D890000-0x00007FFF7D8A0000-memory.dmp

Download

memory/1372-401-0x00007FFF7B470000-0x00007FFF7B480000-memory.dmp

Download

memory/1372-400-0x00007FFF7B470000-0x00007FFF7B480000-memory.dmp

Download

memory/1372-395-0x00007FFF7D890000-0x00007FFF7D8A0000-memory.dmp

Download

memory/1372-396-0x00007FFF7D890000-0x00007FFF7D8A0000-memory.dmp

Download

memory/1372-397-0x00007FFF7D890000-0x00007FFF7D8A0000-memory.dmp

Download

memory/1372-398-0x00007FFF7D890000-0x00007FFF7D8A0000-memory.dmp

Download

memory/4028-134-0x0000000005100000-0x0000000005166000-memory.dmp

Download

memory/4028-393-0x0000000006390000-0x00000000063B2000-memory.dmp

Download

memory/4028-315-0x0000000002C30000-0x0000000002C40000-memory.dmp

Download

memory/4028-133-0x0000000000620000-0x00000000007B2000-memory.dmp

Download

memory/4028-415-0x0000000006DB0000-0x0000000006DBA000-memory.dmp

Download

memory/4028-421-0x0000000002C30000-0x0000000002C40000-memory.dmp

Download

memory/4028-422-0x0000000002C30000-0x0000000002C40000-memory.dmp

Download

memory/4028-135-0x0000000002C30000-0x0000000002C40000-memory.dmp

Download

memory/4028-192-0x0000000006970000-0x0000000006A02000-memory.dmp

Download

memory/4028-199-0x0000000007660000-0x0000000007C04000-memory.dmp

Download

memory/4028-201-0x0000000002C30000-0x0000000002C40000-memory.dmp

Download

memory/4028-319-0x0000000002C30000-0x0000000002C40000-memory.dmp

Download