Overview
overview
10Static
static
10Builder.exe
windows7-x64
1Builder.exe
windows10-2004-x64
1Builder.exe
windows7-x64
1Builder.exe
windows10-2004-x64
1Mono.Cecil.Mdb.dll
windows7-x64
1Mono.Cecil.Mdb.dll
windows10-2004-x64
1Mono.Cecil.Pdb.dll
windows7-x64
1Mono.Cecil.Pdb.dll
windows10-2004-x64
1Mono.Cecil.Rocks.dll
windows7-x64
1Mono.Cecil.Rocks.dll
windows10-2004-x64
1Mono.Cecil.dll
windows7-x64
1Mono.Cecil.dll
windows10-2004-x64
1SixLabors....rp.dll
windows7-x64
1SixLabors....rp.dll
windows10-2004-x64
1Spectre.Co...rp.dll
windows7-x64
1Spectre.Co...rp.dll
windows10-2004-x64
1Spectre.Console.dll
windows7-x64
1Spectre.Console.dll
windows10-2004-x64
1Stub/stub.exe
windows7-x64
1Stub/stub.exe
windows10-2004-x64
10Analysis
-
max time kernel
9s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2023 13:14
Behavioral task
behavioral1
Sample
Builder.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
Builder.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral3
Sample
Builder.exe
Resource
win7-20230703-en
Behavioral task
behavioral4
Sample
Builder.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
Mono.Cecil.Mdb.dll
Resource
win7-20230703-en
Behavioral task
behavioral6
Sample
Mono.Cecil.Mdb.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
Mono.Cecil.Pdb.dll
Resource
win7-20230703-en
Behavioral task
behavioral8
Sample
Mono.Cecil.Pdb.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
Mono.Cecil.Rocks.dll
Resource
win7-20230703-en
Behavioral task
behavioral10
Sample
Mono.Cecil.Rocks.dll
Resource
win10v2004-20230621-en
Behavioral task
behavioral11
Sample
Mono.Cecil.dll
Resource
win7-20230703-en
Behavioral task
behavioral12
Sample
Mono.Cecil.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
SixLabors.ImageSharp.dll
Resource
win7-20230703-en
Behavioral task
behavioral14
Sample
SixLabors.ImageSharp.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
Spectre.Console.ImageSharp.dll
Resource
win7-20230621-en
Behavioral task
behavioral16
Sample
Spectre.Console.ImageSharp.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
Spectre.Console.dll
Resource
win7-20230703-en
Behavioral task
behavioral18
Sample
Spectre.Console.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
Stub/stub.exe
Resource
win7-20230703-en
Behavioral task
behavioral20
Sample
Stub/stub.exe
Resource
win10v2004-20230703-en
General
-
Target
Stub/stub.exe
-
Size
1.6MB
-
MD5
303df0ff45fc487db83f9a14a7eb3594
-
SHA1
e36f528cefba775bf21f04cc208e90b815df8234
-
SHA256
35b48e9472a04ef28d51e5af06dafc8d8573d22bd4159cfc5007b7321a0aa337
-
SHA512
1ebaec29abe8bf659255a3e78893921a5916f8ab8c8d9f607da27e6284cc885c0951bcda7bcbc6cfb47e650a3f1f96c575f0e38881474a227c02ce84821e11a2
-
SSDEEP
24576:Di2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgLs:mTq24GjdGSiqkqXfd+/9AqYanieKd
Malware Config
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
stub.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation stub.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4724 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4968 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
stub.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4920 stub.exe Token: SeDebugPrivilege 4968 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
stub.execmd.exedescription pid process target process PID 4920 wrote to memory of 3620 4920 stub.exe cmd.exe PID 4920 wrote to memory of 3620 4920 stub.exe cmd.exe PID 4920 wrote to memory of 3620 4920 stub.exe cmd.exe PID 3620 wrote to memory of 4052 3620 cmd.exe chcp.com PID 3620 wrote to memory of 4052 3620 cmd.exe chcp.com PID 3620 wrote to memory of 4052 3620 cmd.exe chcp.com PID 3620 wrote to memory of 4968 3620 cmd.exe taskkill.exe PID 3620 wrote to memory of 4968 3620 cmd.exe taskkill.exe PID 3620 wrote to memory of 4968 3620 cmd.exe taskkill.exe PID 3620 wrote to memory of 4724 3620 cmd.exe timeout.exe PID 3620 wrote to memory of 4724 3620 cmd.exe timeout.exe PID 3620 wrote to memory of 4724 3620 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stub\stub.exe"C:\Users\Admin\AppData\Local\Temp\Stub\stub.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp7B6A.tmp.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:4052
-
C:\Windows\SysWOW64\taskkill.exeTaskKill /F /IM 49203⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4968 -
C:\Windows\SysWOW64\timeout.exeTimeout /T 2 /Nobreak3⤵
- Delays execution with timeout.exe
PID:4724
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57B
MD5fd457c1be8e15c90e2d4c911c7325b49
SHA1cd97c994dc9cf8549a61a39a1eb2382803fe6c83
SHA256240a8c5a4249edd768792499da0ef3ed8011c03614b2473ca9bdcef76ac06291
SHA512875dc246a7fa770a74ed531854a9c70b8c77c8ac5ba29f0dfea5fab2714a5ccc097fae301f02f316837c0bb0e039b135107a8392edbd4076ddf8aa8832e35581