Overview
overview
10Static
static
10Builder.exe
windows7-x64
1Builder.exe
windows10-2004-x64
1Builder.exe
windows7-x64
1Builder.exe
windows10-2004-x64
1Mono.Cecil.Mdb.dll
windows7-x64
1Mono.Cecil.Mdb.dll
windows10-2004-x64
1Mono.Cecil.Pdb.dll
windows7-x64
1Mono.Cecil.Pdb.dll
windows10-2004-x64
1Mono.Cecil.Rocks.dll
windows7-x64
1Mono.Cecil.Rocks.dll
windows10-2004-x64
1Mono.Cecil.dll
windows7-x64
1Mono.Cecil.dll
windows10-2004-x64
1SixLabors....rp.dll
windows7-x64
1SixLabors....rp.dll
windows10-2004-x64
1Spectre.Co...rp.dll
windows7-x64
1Spectre.Co...rp.dll
windows10-2004-x64
1Spectre.Console.dll
windows7-x64
1Spectre.Console.dll
windows10-2004-x64
1Stub/stub.exe
windows7-x64
1Stub/stub.exe
windows10-2004-x64
10Analysis
-
max time kernel
135s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2023 18:32
Behavioral task
behavioral1
Sample
Builder.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Builder.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Builder.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Builder.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Mono.Cecil.Mdb.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Mono.Cecil.Mdb.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Mono.Cecil.Pdb.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Mono.Cecil.Pdb.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Mono.Cecil.Rocks.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Mono.Cecil.Rocks.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Mono.Cecil.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Mono.Cecil.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
SixLabors.ImageSharp.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
SixLabors.ImageSharp.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Spectre.Console.ImageSharp.dll
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Spectre.Console.ImageSharp.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Spectre.Console.dll
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Spectre.Console.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Stub/stub.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Stub/stub.exe
Resource
win10v2004-20230220-en
General
-
Target
Stub/stub.exe
-
Size
1.6MB
-
MD5
0bbe9bc948d0154a739c23b4b0521ea1
-
SHA1
74a5c37500bfec5286ec4f0e56663eafb536b9f3
-
SHA256
8a37cfdf9c3d4beca639ead3b11688360333a550aedb60d4dbff82140b9b417e
-
SHA512
78eac69129b53416221fd6663158db0b6d528ad070b8c9887293212639a2c28c20eddbf148c024bd84ea8386992dcb989ded93727d747a46c97ee751f96e92da
-
SSDEEP
24576:i3i2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgL4:nTq24GjdGSiqkqXfd+/9AqYanieKd
Malware Config
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
stub.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation stub.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4728 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4344 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
stub.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1584 stub.exe Token: SeDebugPrivilege 4344 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
stub.execmd.exedescription pid process target process PID 1584 wrote to memory of 4464 1584 stub.exe cmd.exe PID 1584 wrote to memory of 4464 1584 stub.exe cmd.exe PID 1584 wrote to memory of 4464 1584 stub.exe cmd.exe PID 4464 wrote to memory of 3204 4464 cmd.exe chcp.com PID 4464 wrote to memory of 3204 4464 cmd.exe chcp.com PID 4464 wrote to memory of 3204 4464 cmd.exe chcp.com PID 4464 wrote to memory of 4344 4464 cmd.exe taskkill.exe PID 4464 wrote to memory of 4344 4464 cmd.exe taskkill.exe PID 4464 wrote to memory of 4344 4464 cmd.exe taskkill.exe PID 4464 wrote to memory of 4728 4464 cmd.exe timeout.exe PID 4464 wrote to memory of 4728 4464 cmd.exe timeout.exe PID 4464 wrote to memory of 4728 4464 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stub\stub.exe"C:\Users\Admin\AppData\Local\Temp\Stub\stub.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpE822.tmp.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:3204
-
C:\Windows\SysWOW64\taskkill.exeTaskKill /F /IM 15843⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4344 -
C:\Windows\SysWOW64\timeout.exeTimeout /T 2 /Nobreak3⤵
- Delays execution with timeout.exe
PID:4728
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57B
MD5b9637fef013e13ed67e92170a96ac0c4
SHA1aae21fe744d7932dc89c583e4245774471eca6d7
SHA2568e8db0838557e3e38ad6c47977e788daecab3e9a5e5583c0acfb51f26d836519
SHA5125754c179f74468b81955d54f71a7a202877e7a33b7eebd6d866f1b4938aba786956d405931e63debbd74059527b2b346925ac5c2295e47daa8914e9f0d04de8d