Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2023 18:32
Behavioral task
behavioral1
Sample
stub.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
stub.exe
Resource
win10v2004-20230220-en
General
-
Target
stub.exe
-
Size
1.6MB
-
MD5
0bbe9bc948d0154a739c23b4b0521ea1
-
SHA1
74a5c37500bfec5286ec4f0e56663eafb536b9f3
-
SHA256
8a37cfdf9c3d4beca639ead3b11688360333a550aedb60d4dbff82140b9b417e
-
SHA512
78eac69129b53416221fd6663158db0b6d528ad070b8c9887293212639a2c28c20eddbf148c024bd84ea8386992dcb989ded93727d747a46c97ee751f96e92da
-
SSDEEP
24576:i3i2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgL4:nTq24GjdGSiqkqXfd+/9AqYanieKd
Malware Config
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
stub.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation stub.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3508 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3712 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
stub.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1788 stub.exe Token: SeDebugPrivilege 3712 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
stub.execmd.exedescription pid process target process PID 1788 wrote to memory of 5108 1788 stub.exe cmd.exe PID 1788 wrote to memory of 5108 1788 stub.exe cmd.exe PID 1788 wrote to memory of 5108 1788 stub.exe cmd.exe PID 5108 wrote to memory of 208 5108 cmd.exe chcp.com PID 5108 wrote to memory of 208 5108 cmd.exe chcp.com PID 5108 wrote to memory of 208 5108 cmd.exe chcp.com PID 5108 wrote to memory of 3712 5108 cmd.exe taskkill.exe PID 5108 wrote to memory of 3712 5108 cmd.exe taskkill.exe PID 5108 wrote to memory of 3712 5108 cmd.exe taskkill.exe PID 5108 wrote to memory of 3508 5108 cmd.exe timeout.exe PID 5108 wrote to memory of 3508 5108 cmd.exe timeout.exe PID 5108 wrote to memory of 3508 5108 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\stub.exe"C:\Users\Admin\AppData\Local\Temp\stub.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpCE80.tmp.bat2⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:208
-
C:\Windows\SysWOW64\taskkill.exeTaskKill /F /IM 17883⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3712 -
C:\Windows\SysWOW64\timeout.exeTimeout /T 2 /Nobreak3⤵
- Delays execution with timeout.exe
PID:3508
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57B
MD589ee111f1c68257274ce6d32fc411dc4
SHA12bd2825dc2a7dd3635bdad31df5da31a001b22dd
SHA2561c0b9a3dfd0b4c2a18e50e11591cbf2bfcdf5ad80045fc44b5089b6cce8f3c7a
SHA512e77838db0447abe2ff8c3e255281e0685b35128376fb553c349e1b36cbfc44494a5f99727bc4910c6ec7b7960f9a7f041c0d29c1badd869ba9633b1f092915ca