Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-06-2023 01:05

General

  • Target

    https://anonfiles.com/zcs165y1zc/Silly_Boost_rar

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1122480734226096179/1Aw4ALLBbu0auTmgRUo4dv8X6p1Zh7uLpU1Rdderh9NiImTJc0TwRM1SLzpjcALcAja6

Signatures

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://anonfiles.com/zcs165y1zc/Silly_Boost_rar
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4488
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4488 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2472
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Program Files\7-Zip\7z.exe
      "C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\Silly Boost.rar"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5064
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3752
    • C:\Program Files\7-Zip\7zG.exe
      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap29819:84:7zEvent16555
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1464
    • C:\Users\Admin\Downloads\Silly Boost\Silly Boost.exe
      "C:\Users\Admin\Downloads\Silly Boost\Silly Boost.exe"
      1⤵
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:1408
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3636
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          3⤵
            PID:4688
          • C:\Windows\SysWOW64\netsh.exe
            netsh wlan show profile
            3⤵
              PID:1860
            • C:\Windows\SysWOW64\findstr.exe
              findstr All
              3⤵
                PID:2360
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4408
              • C:\Windows\SysWOW64\chcp.com
                chcp 65001
                3⤵
                  PID:1444
                • C:\Windows\SysWOW64\netsh.exe
                  netsh wlan show networks mode=bssid
                  3⤵
                    PID:716
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2896
              • C:\Users\Admin\Downloads\Silly Boost\Silly Boost.exe
                "C:\Users\Admin\Downloads\Silly Boost\Silly Boost.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:3788
              • C:\Windows\system32\taskmgr.exe
                "C:\Windows\system32\taskmgr.exe" /4
                1⤵
                • Checks SCSI registry key(s)
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:5076

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\0e717741ca6a4fff1d8f6ab24cf77af8\Admin@FGVGNMBE_en-US\Browsers\Firefox\Bookmarks.txt

                Filesize

                105B

                MD5

                2e9d094dda5cdc3ce6519f75943a4ff4

                SHA1

                5d989b4ac8b699781681fe75ed9ef98191a5096c

                SHA256

                c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                SHA512

                d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

              • C:\Users\Admin\AppData\Local\0e717741ca6a4fff1d8f6ab24cf77af8\Admin@FGVGNMBE_en-US\Directories\OneDrive.txt

                Filesize

                25B

                MD5

                966247eb3ee749e21597d73c4176bd52

                SHA1

                1e9e63c2872cef8f015d4b888eb9f81b00a35c79

                SHA256

                8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

                SHA512

                bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

              • C:\Users\Admin\AppData\Local\0e717741ca6a4fff1d8f6ab24cf77af8\Admin@FGVGNMBE_en-US\Directories\Startup.txt

                Filesize

                24B

                MD5

                68c93da4981d591704cea7b71cebfb97

                SHA1

                fd0f8d97463cd33892cc828b4ad04e03fc014fa6

                SHA256

                889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

                SHA512

                63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

              • C:\Users\Admin\AppData\Local\0e717741ca6a4fff1d8f6ab24cf77af8\Admin@FGVGNMBE_en-US\Directories\Videos.txt

                Filesize

                23B

                MD5

                1fddbf1169b6c75898b86e7e24bc7c1f

                SHA1

                d2091060cb5191ff70eb99c0088c182e80c20f8c

                SHA256

                a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

                SHA512

                20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

              • C:\Users\Admin\AppData\Local\0e717741ca6a4fff1d8f6ab24cf77af8\Admin@FGVGNMBE_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\Silly Boost\tokens.txt

                Filesize

                3KB

                MD5

                a848dcb207336284a7879589f3f4a0d1

                SHA1

                1f7cd8b2f2476038f54ab53e77a959b665f20fd0

                SHA256

                bca00833e24ba2891b11f6d3da58768ab2b924efb662c1c79973d840e3790542

                SHA512

                2dd3c4edaf591667dda25e31fca7185cfcec79ad93fd70b19a34498607e141cd7d93d72d087ec356d9125d2e38f56d23dda78cda21af983b2d1eff6eaf2d72a8

              • C:\Users\Admin\AppData\Local\0e717741ca6a4fff1d8f6ab24cf77af8\Admin@FGVGNMBE_en-US\System\Apps.txt

                Filesize

                4KB

                MD5

                d32c9e7cfe54f13b21f01375c28de50e

                SHA1

                679e6b1b6667c7b064ca6ed4048ba6bbdf2316f9

                SHA256

                5c88c2a113cc3e0b7e1f96f35121b2e5d3cd67f7317d57a23fbd7b0d649b2f6a

                SHA512

                119e2a4114bec6b397aece914a31e3d0fa4fc625804958dad763328dc1f9a27ecb7635047c8a1648bcc10a2367df1d160b23e67240a02e265f7e8e84d0e13ddb

              • C:\Users\Admin\AppData\Local\0e717741ca6a4fff1d8f6ab24cf77af8\Admin@FGVGNMBE_en-US\System\Debug.txt

                Filesize

                323B

                MD5

                f25e650d41f7fe53a9fff6f21315300f

                SHA1

                828db3e0247918b1c753a00c49d1cec695095e1a

                SHA256

                b1df56112360ca386b9ea1149d3712de20aba277fa2e5a097ad505c7261f50ec

                SHA512

                fdced45f03220f8e3d902c27854600edf92bf9c03273dc2cd4b8d8cbda6bedb4de3dcea7c6b06844c08579a398ee7dac3c1be4fe4707b478fb8f2e2bc93826bc

              • C:\Users\Admin\AppData\Local\0e717741ca6a4fff1d8f6ab24cf77af8\Admin@FGVGNMBE_en-US\System\Process.txt

                Filesize

                4KB

                MD5

                30446715fef7b73ea9bedb2eda4acdb4

                SHA1

                1ad6e5d32a2bb2f62292f167fb4f3cea1f15843a

                SHA256

                1c73e3eae46247502e19957daa7253c647f24d4fb709643540e0e119ae6c762c

                SHA512

                46ca6da44b140a1a502e4689208d88a7a5da7ad15afb3a1391225265628c05f018eaaaa9537135214145c86811d34545d1aaf0aef61c91584899fb52e495ded5

              • C:\Users\Admin\AppData\Local\0e717741ca6a4fff1d8f6ab24cf77af8\Admin@FGVGNMBE_en-US\System\ProductKey.txt

                Filesize

                29B

                MD5

                71eb5479298c7afc6d126fa04d2a9bde

                SHA1

                a9b3d5505cf9f84bb6c2be2acece53cb40075113

                SHA256

                f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

                SHA512

                7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

              • C:\Users\Admin\AppData\Local\0e717741ca6a4fff1d8f6ab24cf77af8\msgid.dat

                Filesize

                19B

                MD5

                766c1c3c519de0b8513ba2666cc12f4e

                SHA1

                21b93bf41e404dab11e9f0acc6fc242652a1d5c8

                SHA256

                cb7a424e8ef7174bed586d93a8eaecf47d8fd8595240f1d76977b1fbd511a594

                SHA512

                4b65423559cb8e901f0fb235078bdb66817fd0d9e2e4dd2ddb3b6b8f8613abdd844cd342dc4019e538f84e79f09fbd1e5fde912857bfc9f6cfb7fcec749b2b53

              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\5qy8zhw\imagestore.dat

                Filesize

                1KB

                MD5

                8e024fbe3e899c1cb6faed1ecce72048

                SHA1

                b4d45e6d7c0b5f66368807b8570ee1011b98d457

                SHA256

                bf7d9c132769a7d432494484f75e26f9dc66db79b0815eebbbf4dded8c5d24ef

                SHA512

                ab74c9591019d608175fd18ee5f51985f1949ae7b4be4302ae7f275b56c21f7a071f4a16d25b43a60ed90e13077cc6fdd2075e8330b7e97ac188174492ecbdd3

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

                Filesize

                28KB

                MD5

                ca91957dba9acf19445a2f7c977ffc60

                SHA1

                196aed0b910df1718341c0441a468cabcd0ed2c9

                SHA256

                f62e73804a1dba00c375f0e135c32e9fa07576b86d2c053e1944be2ec427e9e3

                SHA512

                a29c82d0bab21b9ab82aced416f735503383345049f90ef02ca4198c21060f2da31dc3e163305e7c3e050d55b2d7f9645f0ad7a63fa76531e3b389e2293b83ed

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

                Filesize

                28KB

                MD5

                e1b08586b0b02f40fb0fa772535bb5ba

                SHA1

                45f7cd31a7a0ac477813f3880e0171400c4ecc54

                SHA256

                522300e43298a67570a5564bda21135ddb91bda2b45686424997bb9b99ccd37e

                SHA512

                cb132ba980d46b8a7640df7da7303d914dc11ddc535bcbefdcfbbf16aeb7ffbc60d576d3aae2eef28c8a2201b7d4d4248a8336b80636942074fd7f0170a362e8

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U74AOVB4\Silly Boost[1].rar

                Filesize

                1.5MB

                MD5

                43dfeeaabbd337e88aa8db402e695017

                SHA1

                c7f70d5da0a576964f4ffed550ebbb04e77eaff4

                SHA256

                0f426d80c8be8e7df72af481f982e34e1fe86681a39afdd68572e7bca91dbac1

                SHA512

                0fccbbc682341bde0108a3b9a18453a9b9fad553cb5ef101063956090634bd5ada2d45205c124b48aac074a6096d5d0bf510faaf7f2b73ffbfb0d6725924ce64

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U74AOVB4\favicon-32x32-anonfiles[1].png

                Filesize

                1KB

                MD5

                ee0e6dd4ef643128a1b7bd4ab32b8a79

                SHA1

                8136c70aac1e50f8356c83f91fb77ea4b6596cbc

                SHA256

                51f305558b4ed6fcf3a31b4f9e404fc2ea426cb5e785ac46ce827de0c5cabb4c

                SHA512

                f57a1882e4d57f6cdb67fc5b8ed61d0dba28f000af87644bfd402275958163b66f7748b83e4d78dff72bb8edd9077c3fe67f5e831a6b79bce72ca4bd1d086b34

              • C:\Users\Admin\AppData\Local\Temp\~DF8BE4D3ED6C75FCB1.TMP

                Filesize

                16KB

                MD5

                b533db809402e6ce5f30b8e29adb9940

                SHA1

                f91ca55ed8ef8a73ba9153f1a119a4e57ff53dea

                SHA256

                994e234fe5f2c9ce65870913f9c1c9b5e355082f8face5c89fd6e4878c9d7c30

                SHA512

                2ea4b55700d2cfe6cfb084450ab02cedc1dccd08ff5cd702f6c5e67d34d33dde0792787a6e1ee4dfe9a3b4ed71b486931d35d63fe435a00137ae06dd0fee7c86

              • C:\Users\Admin\Downloads\Silly Boost.rar.93q7u3k.partial

                Filesize

                1.5MB

                MD5

                43dfeeaabbd337e88aa8db402e695017

                SHA1

                c7f70d5da0a576964f4ffed550ebbb04e77eaff4

                SHA256

                0f426d80c8be8e7df72af481f982e34e1fe86681a39afdd68572e7bca91dbac1

                SHA512

                0fccbbc682341bde0108a3b9a18453a9b9fad553cb5ef101063956090634bd5ada2d45205c124b48aac074a6096d5d0bf510faaf7f2b73ffbfb0d6725924ce64

              • C:\Users\Admin\Downloads\Silly Boost\Silly Boost.exe

                Filesize

                1.6MB

                MD5

                6168cae808b3f34d187c03d9a4c975cc

                SHA1

                cc119a9d255a2a2be791314420345e778c8655ac

                SHA256

                80b39b93254011afc3b601c26e848114850ea31d722a45c03daff7b4f3f606da

                SHA512

                d6df9688e8509318fb91c0462056f4bac0dcbdfee8e9feec6aa367e8804d76fc56c0bdfdbfbe1386a2886cbdd6c2aa7566cdef20e3efffe8c0459cdcb9486454

              • C:\Users\Admin\Downloads\Silly Boost\Silly Boost.exe

                Filesize

                1.6MB

                MD5

                6168cae808b3f34d187c03d9a4c975cc

                SHA1

                cc119a9d255a2a2be791314420345e778c8655ac

                SHA256

                80b39b93254011afc3b601c26e848114850ea31d722a45c03daff7b4f3f606da

                SHA512

                d6df9688e8509318fb91c0462056f4bac0dcbdfee8e9feec6aa367e8804d76fc56c0bdfdbfbe1386a2886cbdd6c2aa7566cdef20e3efffe8c0459cdcb9486454

              • C:\Users\Admin\Downloads\Silly Boost\Silly Boost.exe

                Filesize

                1.6MB

                MD5

                6168cae808b3f34d187c03d9a4c975cc

                SHA1

                cc119a9d255a2a2be791314420345e778c8655ac

                SHA256

                80b39b93254011afc3b601c26e848114850ea31d722a45c03daff7b4f3f606da

                SHA512

                d6df9688e8509318fb91c0462056f4bac0dcbdfee8e9feec6aa367e8804d76fc56c0bdfdbfbe1386a2886cbdd6c2aa7566cdef20e3efffe8c0459cdcb9486454

              • C:\Users\Admin\Downloads\Silly Boost\tokens.txt

                Filesize

                3KB

                MD5

                a848dcb207336284a7879589f3f4a0d1

                SHA1

                1f7cd8b2f2476038f54ab53e77a959b665f20fd0

                SHA256

                bca00833e24ba2891b11f6d3da58768ab2b924efb662c1c79973d840e3790542

                SHA512

                2dd3c4edaf591667dda25e31fca7185cfcec79ad93fd70b19a34498607e141cd7d93d72d087ec356d9125d2e38f56d23dda78cda21af983b2d1eff6eaf2d72a8

              • memory/1408-243-0x00000000051D0000-0x00000000051E0000-memory.dmp

                Filesize

                64KB

              • memory/1408-242-0x0000000005250000-0x00000000052B6000-memory.dmp

                Filesize

                408KB

              • memory/1408-529-0x00000000051D0000-0x00000000051E0000-memory.dmp

                Filesize

                64KB

              • memory/1408-528-0x0000000006F80000-0x0000000006F8A000-memory.dmp

                Filesize

                40KB

              • memory/1408-241-0x0000000000870000-0x0000000000A04000-memory.dmp

                Filesize

                1.6MB

              • memory/1408-516-0x0000000006E00000-0x0000000006E22000-memory.dmp

                Filesize

                136KB

              • memory/1408-247-0x00000000051D0000-0x00000000051E0000-memory.dmp

                Filesize

                64KB

              • memory/1408-305-0x00000000074A0000-0x0000000007532000-memory.dmp

                Filesize

                584KB

              • memory/1408-308-0x0000000007AF0000-0x0000000008094000-memory.dmp

                Filesize

                5.6MB

              • memory/1408-436-0x00000000051D0000-0x00000000051E0000-memory.dmp

                Filesize

                64KB

              • memory/3788-348-0x0000000002870000-0x0000000002880000-memory.dmp

                Filesize

                64KB

              • memory/5076-404-0x000002C88A320000-0x000002C88A321000-memory.dmp

                Filesize

                4KB

              • memory/5076-416-0x000002C88A320000-0x000002C88A321000-memory.dmp

                Filesize

                4KB

              • memory/5076-420-0x000002C88A320000-0x000002C88A321000-memory.dmp

                Filesize

                4KB

              • memory/5076-419-0x000002C88A320000-0x000002C88A321000-memory.dmp

                Filesize

                4KB

              • memory/5076-417-0x000002C88A320000-0x000002C88A321000-memory.dmp

                Filesize

                4KB

              • memory/5076-407-0x000002C88A320000-0x000002C88A321000-memory.dmp

                Filesize

                4KB

              • memory/5076-414-0x000002C88A320000-0x000002C88A321000-memory.dmp

                Filesize

                4KB

              • memory/5076-413-0x000002C88A320000-0x000002C88A321000-memory.dmp

                Filesize

                4KB

              • memory/5076-412-0x000002C88A320000-0x000002C88A321000-memory.dmp

                Filesize

                4KB

              • memory/5076-405-0x000002C88A320000-0x000002C88A321000-memory.dmp

                Filesize

                4KB