Analysis

  • max time kernel
    135s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2023 18:32

General

  • Target

    Stub/stub.exe

  • Size

    1.6MB

  • MD5

    0bbe9bc948d0154a739c23b4b0521ea1

  • SHA1

    74a5c37500bfec5286ec4f0e56663eafb536b9f3

  • SHA256

    8a37cfdf9c3d4beca639ead3b11688360333a550aedb60d4dbff82140b9b417e

  • SHA512

    78eac69129b53416221fd6663158db0b6d528ad070b8c9887293212639a2c28c20eddbf148c024bd84ea8386992dcb989ded93727d747a46c97ee751f96e92da

  • SSDEEP

    24576:i3i2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgL4:nTq24GjdGSiqkqXfd+/9AqYanieKd

Score
10/10

Malware Config

Signatures

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Stub\stub.exe
    "C:\Users\Admin\AppData\Local\Temp\Stub\stub.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1584
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpE822.tmp.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4464
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:3204
        • C:\Windows\SysWOW64\taskkill.exe
          TaskKill /F /IM 1584
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4344
        • C:\Windows\SysWOW64\timeout.exe
          Timeout /T 2 /Nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:4728

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpE822.tmp.bat

      Filesize

      57B

      MD5

      b9637fef013e13ed67e92170a96ac0c4

      SHA1

      aae21fe744d7932dc89c583e4245774471eca6d7

      SHA256

      8e8db0838557e3e38ad6c47977e788daecab3e9a5e5583c0acfb51f26d836519

      SHA512

      5754c179f74468b81955d54f71a7a202877e7a33b7eebd6d866f1b4938aba786956d405931e63debbd74059527b2b346925ac5c2295e47daa8914e9f0d04de8d

    • memory/1584-133-0x00000000001F0000-0x0000000000382000-memory.dmp

      Filesize

      1.6MB

    • memory/1584-134-0x0000000004CE0000-0x0000000004D46000-memory.dmp

      Filesize

      408KB

    • memory/1584-135-0x0000000004E20000-0x0000000004E30000-memory.dmp

      Filesize

      64KB