Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2023 11:47

General

  • Target

    build.exe

  • Size

    1.6MB

  • MD5

    859bc46c49e73a343435f0bc6bc34316

  • SHA1

    2958bda05d4286139fd5d4dc8214ca1beed52ee5

  • SHA256

    659104df997bdd55eab8acd0e70d6333935a07855c0e2af9fa1a620d5c903af3

  • SHA512

    99bc8b0b80c3cb48d8061419bb628040d11165bc5814ef26c005083f54bc617eb3744849bcbf604bba9c37539f8de5c3a2cfa49dded218808eee6a6302fdeda0

  • SSDEEP

    24576:Hi2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgLJ:CTq24GjdGSiqkqXfd+/9AqYanieKd

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1119171816687149056/0B8BKIQfBKmrRYNQcdcs6n7YHcS4MB5yYXNnj3GBhRUYpBVvxdhVLNoP-_EpEyJ8sjKp

Signatures

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:2680
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4828
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:1516
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show profile
          3⤵
            PID:2760
          • C:\Windows\SysWOW64\findstr.exe
            findstr All
            3⤵
              PID:1788
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1044
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              3⤵
                PID:2464
              • C:\Windows\SysWOW64\netsh.exe
                netsh wlan show networks mode=bssid
                3⤵
                  PID:880
            • C:\Windows\system32\msiexec.exe
              C:\Windows\system32\msiexec.exe /V
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3360

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\Browsers\Firefox\Bookmarks.txt

              Filesize

              105B

              MD5

              2e9d094dda5cdc3ce6519f75943a4ff4

              SHA1

              5d989b4ac8b699781681fe75ed9ef98191a5096c

              SHA256

              c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

              SHA512

              d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

            • C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\Directories\OneDrive.txt

              Filesize

              25B

              MD5

              966247eb3ee749e21597d73c4176bd52

              SHA1

              1e9e63c2872cef8f015d4b888eb9f81b00a35c79

              SHA256

              8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

              SHA512

              bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

            • C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\Directories\Startup.txt

              Filesize

              24B

              MD5

              68c93da4981d591704cea7b71cebfb97

              SHA1

              fd0f8d97463cd33892cc828b4ad04e03fc014fa6

              SHA256

              889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

              SHA512

              63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

            • C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\Directories\Videos.txt

              Filesize

              23B

              MD5

              1fddbf1169b6c75898b86e7e24bc7c1f

              SHA1

              d2091060cb5191ff70eb99c0088c182e80c20f8c

              SHA256

              a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

              SHA512

              20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

            • C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\System\Apps.txt

              Filesize

              4KB

              MD5

              d9f4d5687778f58d4990c77ae75d77c6

              SHA1

              bc8ca830d7e066af3854e44d31233ce3f3a76285

              SHA256

              0811ef6e61cd5f91a19e73ec03494bb1b1aea4578cdc7a2bd7732a1522eb256e

              SHA512

              b2ae841829d6466b81dc11afe7a77a5dd5520783e6b5882f53c19769ecd225a6b2db08dd7cbf54ebe9cdd8c40b276cdde1ebf25f699878987b3882a556465ae0

            • C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\System\Apps.txt

              Filesize

              4KB

              MD5

              d9f4d5687778f58d4990c77ae75d77c6

              SHA1

              bc8ca830d7e066af3854e44d31233ce3f3a76285

              SHA256

              0811ef6e61cd5f91a19e73ec03494bb1b1aea4578cdc7a2bd7732a1522eb256e

              SHA512

              b2ae841829d6466b81dc11afe7a77a5dd5520783e6b5882f53c19769ecd225a6b2db08dd7cbf54ebe9cdd8c40b276cdde1ebf25f699878987b3882a556465ae0

            • C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\System\Debug.txt

              Filesize

              293B

              MD5

              11c01c027d28f7d3eeccc87dcf872671

              SHA1

              38694c7dade16ed200ff90c9ea144add6cee155c

              SHA256

              f4bbc1f4415495f04667e1f74fcfc1cbd5f35c7df263c397759873c4af91e70f

              SHA512

              46ea49360f2b598f4a93124c46d6628ce1ee1173e7ae80b0a2337a54d0262480c0141984986a9be5767c1ac61d7aa14b5a660d237e764fb2f19344c0349763d8

            • C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\System\Process.txt

              Filesize

              4KB

              MD5

              cb8531814f0c376dbfd3ed2bff497e7c

              SHA1

              5d2094688698e730fc596997fa202a0d86d318e2

              SHA256

              06bb803857e868e513ee94bd8d63c8f85f0e63f73387699eeb06c206ffc684a0

              SHA512

              ce4c435242dddd79f51caf1e984c9eadb60a2e2e5ab7366312c30056f4481776c49fb38e17fa7b2b8705a323cb132e6449b1b01d7e8d3f2145f25a42e73f203c

            • C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\Admin@WEYPCEWN_en-US\System\ProductKey.txt

              Filesize

              29B

              MD5

              71eb5479298c7afc6d126fa04d2a9bde

              SHA1

              a9b3d5505cf9f84bb6c2be2acece53cb40075113

              SHA256

              f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

              SHA512

              7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

            • C:\Users\Admin\AppData\Local\51dcdf0ab107fa0975b49ecb09279db5\msgid.dat

              Filesize

              19B

              MD5

              2da62216c27f89d3e985ef62f979e56e

              SHA1

              4d37f25ce0d6c8be545e0ed69f3cf2762662e9e8

              SHA256

              1018a378df9ab7c421645e25345c8a20f1efc5bc4dd9b50f70f539f9c0c84cc0

              SHA512

              1a5a2721c0382b98babbdd7b3078b9ac6ac06bf76fa27dfafc3d8746d0466d6ff9fdcc911178f6725de0fc33363a5d403b6ebea0f9f60340606acc6d8676a430

            • memory/2680-236-0x0000000005230000-0x0000000005240000-memory.dmp

              Filesize

              64KB

            • memory/2680-196-0x00000000078F0000-0x0000000007E94000-memory.dmp

              Filesize

              5.6MB

            • memory/2680-133-0x00000000005F0000-0x0000000000782000-memory.dmp

              Filesize

              1.6MB

            • memory/2680-309-0x0000000005230000-0x0000000005240000-memory.dmp

              Filesize

              64KB

            • memory/2680-173-0x0000000006CA0000-0x0000000006D32000-memory.dmp

              Filesize

              584KB

            • memory/2680-135-0x0000000005230000-0x0000000005240000-memory.dmp

              Filesize

              64KB

            • memory/2680-134-0x0000000005110000-0x0000000005176000-memory.dmp

              Filesize

              408KB

            • memory/2680-379-0x0000000006B10000-0x0000000006B32000-memory.dmp

              Filesize

              136KB

            • memory/2680-391-0x0000000006AA0000-0x0000000006AAA000-memory.dmp

              Filesize

              40KB

            • memory/2680-392-0x0000000005230000-0x0000000005240000-memory.dmp

              Filesize

              64KB