Analysis

  • max time kernel
    145s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2023 18:32

General

  • Target

    stub.exe

  • Size

    1.6MB

  • MD5

    0bbe9bc948d0154a739c23b4b0521ea1

  • SHA1

    74a5c37500bfec5286ec4f0e56663eafb536b9f3

  • SHA256

    8a37cfdf9c3d4beca639ead3b11688360333a550aedb60d4dbff82140b9b417e

  • SHA512

    78eac69129b53416221fd6663158db0b6d528ad070b8c9887293212639a2c28c20eddbf148c024bd84ea8386992dcb989ded93727d747a46c97ee751f96e92da

  • SSDEEP

    24576:i3i2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgL4:nTq24GjdGSiqkqXfd+/9AqYanieKd

Score
10/10

Malware Config

Signatures

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\stub.exe
    "C:\Users\Admin\AppData\Local\Temp\stub.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpCE80.tmp.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5108
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:208
        • C:\Windows\SysWOW64\taskkill.exe
          TaskKill /F /IM 1788
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3712
        • C:\Windows\SysWOW64\timeout.exe
          Timeout /T 2 /Nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:3508

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpCE80.tmp.bat

      Filesize

      57B

      MD5

      89ee111f1c68257274ce6d32fc411dc4

      SHA1

      2bd2825dc2a7dd3635bdad31df5da31a001b22dd

      SHA256

      1c0b9a3dfd0b4c2a18e50e11591cbf2bfcdf5ad80045fc44b5089b6cce8f3c7a

      SHA512

      e77838db0447abe2ff8c3e255281e0685b35128376fb553c349e1b36cbfc44494a5f99727bc4910c6ec7b7960f9a7f041c0d29c1badd869ba9633b1f092915ca

    • memory/1788-133-0x0000000000380000-0x0000000000512000-memory.dmp

      Filesize

      1.6MB

    • memory/1788-134-0x0000000004ED0000-0x0000000004F36000-memory.dmp

      Filesize

      408KB

    • memory/1788-135-0x0000000004E50000-0x0000000004E60000-memory.dmp

      Filesize

      64KB