stealerium | a1d070e57e5d9002274f814372596fd59e4ed49ec373020c45ec2ed1f8bf847d

Analysis

max time kernel
1738s
max time network
1173s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2023, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build.exe
Size 1.6MB
Sample231020-eff28sfc34
SHA256 a1d070e57e5d9002274f814372596fd59e4ed49ec373020c45ec2ed1f8bf847d
MD5 8ae754931d3fad28ddd1a546a7399dd9
SHA1 1a3aad1b59e23233085538490681119fb9f3e3f2
SHA512 f6ad9715f0638c0172c4ff151062778e94d4e5d3dd8bdb5fee92862963f497889dbea44210d785b02a3b25e20a1a040197b2e9c1949507f01577a44365f99628
SSDEEP 24576:Oi2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgLn:ZTq24GjdGSiqkqXfd+/9AqYanieKd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealerium stealer

Malware Config

Extracted

Family

stealerium

https://canary.discord.com/api/webhooks/1164771273088438373/LkV7kaD1cZ_ThsbQhH-c6fV9W3Srl_WFpWGvMsPDPwn78bGXZB91nVl5bieA39v-Xvru

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	build.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
4976	timeout.exe
3412	timeout.exe
2392	timeout.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
3780	taskkill.exe
3664	taskkill.exe
2688	taskkill.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2776	build.exe
2960	build.exe
4484	build.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	build.exe
Token: SeDebugPrivilege	3780	taskkill.exe
Token: SeDebugPrivilege	2960	build.exe
Token: SeDebugPrivilege	3664	taskkill.exe
Token: SeDebugPrivilege	4484	build.exe
Token: SeDebugPrivilege	4476	build.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeManageVolumePrivilege	3732	svchost.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4792	2776	build.exe	92
PID 2776 wrote to memory of 4792	2776	build.exe	92
PID 2776 wrote to memory of 4792	2776	build.exe	92
PID 4792 wrote to memory of 2392	4792	cmd.exe	94
PID 4792 wrote to memory of 2392	4792	cmd.exe	94
PID 4792 wrote to memory of 2392	4792	cmd.exe	94
PID 4792 wrote to memory of 3780	4792	cmd.exe	96
PID 4792 wrote to memory of 3780	4792	cmd.exe	96
PID 4792 wrote to memory of 3780	4792	cmd.exe	96
PID 4792 wrote to memory of 4976	4792	cmd.exe	97
PID 4792 wrote to memory of 4976	4792	cmd.exe	97
PID 4792 wrote to memory of 4976	4792	cmd.exe	97
PID 2960 wrote to memory of 1440	2960	build.exe	103
PID 2960 wrote to memory of 1440	2960	build.exe	103
PID 2960 wrote to memory of 1440	2960	build.exe	103
PID 1440 wrote to memory of 2020	1440	cmd.exe	104
PID 1440 wrote to memory of 2020	1440	cmd.exe	104
PID 1440 wrote to memory of 2020	1440	cmd.exe	104
PID 1440 wrote to memory of 3664	1440	cmd.exe	105
PID 1440 wrote to memory of 3664	1440	cmd.exe	105
PID 1440 wrote to memory of 3664	1440	cmd.exe	105
PID 1440 wrote to memory of 3412	1440	cmd.exe	106
PID 1440 wrote to memory of 3412	1440	cmd.exe	106
PID 1440 wrote to memory of 3412	1440	cmd.exe	106
PID 4484 wrote to memory of 2944	4484	build.exe	109
PID 4484 wrote to memory of 2944	4484	build.exe	109
PID 4484 wrote to memory of 2944	4484	build.exe	109
PID 2944 wrote to memory of 4180	2944	cmd.exe	111
PID 2944 wrote to memory of 4180	2944	cmd.exe	111
PID 2944 wrote to memory of 4180	2944	cmd.exe	111
PID 2944 wrote to memory of 2688	2944	cmd.exe	112
PID 2944 wrote to memory of 2688	2944	cmd.exe	112
PID 2944 wrote to memory of 2688	2944	cmd.exe	112
PID 2944 wrote to memory of 2392	2944	cmd.exe	113
PID 2944 wrote to memory of 2392	2944	cmd.exe	113
PID 2944 wrote to memory of 2392	2944	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp856C.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\taskkill.exe
    TaskKill /F /IM 2776
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3780
- - C:\Windows\SysWOW64\timeout.exe
    Timeout /T 2 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4976

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4668

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpBB8F.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:2020
- - C:\Windows\SysWOW64\taskkill.exe
    TaskKill /F /IM 2960
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- - C:\Windows\SysWOW64\timeout.exe
    Timeout /T 2 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3412

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpEEB5.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:4180
- - C:\Windows\SysWOW64\taskkill.exe
    TaskKill /F /IM 4484
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- - C:\Windows\SysWOW64\timeout.exe
    Timeout /T 2 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2392

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp856C.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp856C.tmp.bat
Size 57B
SHA256 82f70785f17d0dce2388340c654067c247ce5b37aff0fa1eeb9181380aad9f1c
MD5 36460a086817968f4a4924cf9862a7d5
SHA1 e4d9bd8c66c59128e919d7c799a9f1b5cabd63e1
SHA512 10bc936392c487c8cfe0a6a481f80ddfaa7a79497296ee431b880ac829a11efe0df19fce2bfe8de366436b2d5436c32edccb666d4d8c4ecde0a2ab6b2b61cb71
MD5 SHA1 SHA512

Submit Download

tmpBB8F.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpBB8F.tmp.bat
Size 57B
SHA256 04f75331e9adb0502aae51a587ab7e88c82f92e20d9e79f5ae732c3ec438af87
MD5 5952ea205e38a6759603e9dfbfe89986
SHA1 bd5be120e84a4854e02ad5daa8749a3b2192e46b
SHA512 83fe6492544716237244bfa13d7053924180fb1b4ec8601acd3afee0b4de50d0268e49a59bbc72db84fa7fbe15680710745d852f3a69b90e6d4f88711e2e25bd
MD5 SHA1 SHA512

Submit Download

tmpEEB5.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpEEB5.tmp.bat
Size 57B
SHA256 42176faa51a463301e85d84a80eda9ee765ba1aa1822004fd8933d7553f40f03
MD5 6e5b41c630ab9c0c86a5e5c85b86c179
SHA1 e3e7f2566a7eae1c102776fe1574088a1b61792c
SHA512 94334e600871dd90c9e8dcbe0c0bbb326644405ef16dbd9023513bfdd976131c846392ceb6a7fc24b73bc1a1d09b83ac009b4c2fa74703d34b55220f5d827c0f
MD5 SHA1 SHA512

Submit Download

memory/2776-1-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Download

memory/2776-2-0x0000000005650000-0x00000000056B6000-memory.dmp

Download

memory/2776-3-0x0000000005640000-0x0000000005650000-memory.dmp

Download

memory/2776-4-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Download

memory/2776-7-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Download

memory/2776-0-0x0000000000AF0000-0x0000000000C82000-memory.dmp

Download

memory/2960-14-0x0000000074490000-0x0000000074C40000-memory.dmp

Download

memory/2960-9-0x0000000005340000-0x0000000005350000-memory.dmp

Download

memory/2960-8-0x0000000074490000-0x0000000074C40000-memory.dmp

Download

memory/3732-23-0x000001B0FF140000-0x000001B0FF150000-memory.dmp

Download

memory/3732-59-0x000001B0FF670000-0x000001B0FF671000-memory.dmp

Download

memory/3732-58-0x000001B0FF560000-0x000001B0FF561000-memory.dmp

Download

memory/3732-57-0x000001B0FF560000-0x000001B0FF561000-memory.dmp

Download

memory/3732-55-0x000001B0FF530000-0x000001B0FF531000-memory.dmp

Download

memory/3732-39-0x000001B0FF240000-0x000001B0FF250000-memory.dmp

Download

memory/4476-19-0x0000000074490000-0x0000000074C40000-memory.dmp

Download

memory/4476-16-0x0000000074490000-0x0000000074C40000-memory.dmp

Download

memory/4484-22-0x0000000074490000-0x0000000074C40000-memory.dmp

Download

memory/4484-10-0x0000000074490000-0x0000000074C40000-memory.dmp

Download

memory/4484-17-0x0000000005160000-0x0000000005170000-memory.dmp

Download

memory/4484-15-0x0000000074490000-0x0000000074C40000-memory.dmp

Download

memory/4484-13-0x0000000005160000-0x0000000005170000-memory.dmp

Download