Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2023 11:47
Behavioral task
behavioral1
Sample
build.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
build.exe
Resource
win10v2004-20230220-en
General
-
Target
build.exe
-
Size
1.6MB
-
MD5
859bc46c49e73a343435f0bc6bc34316
-
SHA1
2958bda05d4286139fd5d4dc8214ca1beed52ee5
-
SHA256
659104df997bdd55eab8acd0e70d6333935a07855c0e2af9fa1a620d5c903af3
-
SHA512
99bc8b0b80c3cb48d8061419bb628040d11165bc5814ef26c005083f54bc617eb3744849bcbf604bba9c37539f8de5c3a2cfa49dded218808eee6a6302fdeda0
-
SSDEEP
24576:Hi2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgLJ:CTq24GjdGSiqkqXfd+/9AqYanieKd
Malware Config
Extracted
stealerium
https://discord.com/api/webhooks/1119171816687149056/0B8BKIQfBKmrRYNQcdcs6n7YHcS4MB5yYXNnj3GBhRUYpBVvxdhVLNoP-_EpEyJ8sjKp
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
build.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 icanhazip.com -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 build.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier build.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
build.exepid process 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe 2680 build.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
build.exemsiexec.exedescription pid process Token: SeDebugPrivilege 2680 build.exe Token: SeSecurityPrivilege 3360 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
build.exepid process 2680 build.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
build.execmd.execmd.exedescription pid process target process PID 2680 wrote to memory of 4828 2680 build.exe cmd.exe PID 2680 wrote to memory of 4828 2680 build.exe cmd.exe PID 2680 wrote to memory of 4828 2680 build.exe cmd.exe PID 4828 wrote to memory of 1516 4828 cmd.exe chcp.com PID 4828 wrote to memory of 1516 4828 cmd.exe chcp.com PID 4828 wrote to memory of 1516 4828 cmd.exe chcp.com PID 4828 wrote to memory of 2760 4828 cmd.exe netsh.exe PID 4828 wrote to memory of 2760 4828 cmd.exe netsh.exe PID 4828 wrote to memory of 2760 4828 cmd.exe netsh.exe PID 4828 wrote to memory of 1788 4828 cmd.exe findstr.exe PID 4828 wrote to memory of 1788 4828 cmd.exe findstr.exe PID 4828 wrote to memory of 1788 4828 cmd.exe findstr.exe PID 2680 wrote to memory of 1044 2680 build.exe cmd.exe PID 2680 wrote to memory of 1044 2680 build.exe cmd.exe PID 2680 wrote to memory of 1044 2680 build.exe cmd.exe PID 1044 wrote to memory of 2464 1044 cmd.exe chcp.com PID 1044 wrote to memory of 2464 1044 cmd.exe chcp.com PID 1044 wrote to memory of 2464 1044 cmd.exe chcp.com PID 1044 wrote to memory of 880 1044 cmd.exe netsh.exe PID 1044 wrote to memory of 880 1044 cmd.exe netsh.exe PID 1044 wrote to memory of 880 1044 cmd.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
build.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe -
outlook_win_path 1 IoCs
Processes:
build.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2680 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:1516
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵PID:2760
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵PID:1788
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:2464
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵PID:880
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3360
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\Browsers\Firefox\Bookmarks.txt
Filesize105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\Directories\OneDrive.txt
Filesize25B
MD5966247eb3ee749e21597d73c4176bd52
SHA11e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA2568ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
SHA512bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
-
C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\Directories\Startup.txt
Filesize24B
MD568c93da4981d591704cea7b71cebfb97
SHA1fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA256889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
SHA51263455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
-
C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\Directories\Videos.txt
Filesize23B
MD51fddbf1169b6c75898b86e7e24bc7c1f
SHA1d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA256a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
SHA51220bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
-
Filesize
4KB
MD5d9f4d5687778f58d4990c77ae75d77c6
SHA1bc8ca830d7e066af3854e44d31233ce3f3a76285
SHA2560811ef6e61cd5f91a19e73ec03494bb1b1aea4578cdc7a2bd7732a1522eb256e
SHA512b2ae841829d6466b81dc11afe7a77a5dd5520783e6b5882f53c19769ecd225a6b2db08dd7cbf54ebe9cdd8c40b276cdde1ebf25f699878987b3882a556465ae0
-
Filesize
4KB
MD5d9f4d5687778f58d4990c77ae75d77c6
SHA1bc8ca830d7e066af3854e44d31233ce3f3a76285
SHA2560811ef6e61cd5f91a19e73ec03494bb1b1aea4578cdc7a2bd7732a1522eb256e
SHA512b2ae841829d6466b81dc11afe7a77a5dd5520783e6b5882f53c19769ecd225a6b2db08dd7cbf54ebe9cdd8c40b276cdde1ebf25f699878987b3882a556465ae0
-
Filesize
293B
MD511c01c027d28f7d3eeccc87dcf872671
SHA138694c7dade16ed200ff90c9ea144add6cee155c
SHA256f4bbc1f4415495f04667e1f74fcfc1cbd5f35c7df263c397759873c4af91e70f
SHA51246ea49360f2b598f4a93124c46d6628ce1ee1173e7ae80b0a2337a54d0262480c0141984986a9be5767c1ac61d7aa14b5a660d237e764fb2f19344c0349763d8
-
C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\System\Process.txt
Filesize4KB
MD5cb8531814f0c376dbfd3ed2bff497e7c
SHA15d2094688698e730fc596997fa202a0d86d318e2
SHA25606bb803857e868e513ee94bd8d63c8f85f0e63f73387699eeb06c206ffc684a0
SHA512ce4c435242dddd79f51caf1e984c9eadb60a2e2e5ab7366312c30056f4481776c49fb38e17fa7b2b8705a323cb132e6449b1b01d7e8d3f2145f25a42e73f203c
-
C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\System\ProductKey.txt
Filesize29B
MD571eb5479298c7afc6d126fa04d2a9bde
SHA1a9b3d5505cf9f84bb6c2be2acece53cb40075113
SHA256f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
SHA5127c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd
-
Filesize
19B
MD52da62216c27f89d3e985ef62f979e56e
SHA14d37f25ce0d6c8be545e0ed69f3cf2762662e9e8
SHA2561018a378df9ab7c421645e25345c8a20f1efc5bc4dd9b50f70f539f9c0c84cc0
SHA5121a5a2721c0382b98babbdd7b3078b9ac6ac06bf76fa27dfafc3d8746d0466d6ff9fdcc911178f6725de0fc33363a5d403b6ebea0f9f60340606acc6d8676a430