Analysis

  • max time kernel
    1738s
  • max time network
    1173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-10-2023 03:52

General

  • Target

    build.exe

  • Size

    1.6MB

  • MD5

    8ae754931d3fad28ddd1a546a7399dd9

  • SHA1

    1a3aad1b59e23233085538490681119fb9f3e3f2

  • SHA256

    a1d070e57e5d9002274f814372596fd59e4ed49ec373020c45ec2ed1f8bf847d

  • SHA512

    f6ad9715f0638c0172c4ff151062778e94d4e5d3dd8bdb5fee92862963f497889dbea44210d785b02a3b25e20a1a040197b2e9c1949507f01577a44365f99628

  • SSDEEP

    24576:Oi2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgLn:ZTq24GjdGSiqkqXfd+/9AqYanieKd

Score
10/10

Malware Config

Extracted

Family

stealerium

C2

https://canary.discord.com/api/webhooks/1164771273088438373/LkV7kaD1cZ_ThsbQhH-c6fV9W3Srl_WFpWGvMsPDPwn78bGXZB91nVl5bieA39v-Xvru

Signatures

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 3 IoCs
  • Kills process with taskkill 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp856C.tmp.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4792
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:2392
        • C:\Windows\SysWOW64\taskkill.exe
          TaskKill /F /IM 2776
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3780
        • C:\Windows\SysWOW64\timeout.exe
          Timeout /T 2 /Nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:4976
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4668
      • C:\Users\Admin\AppData\Local\Temp\build.exe
        "C:\Users\Admin\AppData\Local\Temp\build.exe"
        1⤵
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2960
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpBB8F.tmp.bat
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1440
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            3⤵
              PID:2020
            • C:\Windows\SysWOW64\taskkill.exe
              TaskKill /F /IM 2960
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3664
            • C:\Windows\SysWOW64\timeout.exe
              Timeout /T 2 /Nobreak
              3⤵
              • Delays execution with timeout.exe
              PID:3412
        • C:\Users\Admin\AppData\Local\Temp\build.exe
          "C:\Users\Admin\AppData\Local\Temp\build.exe"
          1⤵
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4484
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpEEB5.tmp.bat
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2944
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              3⤵
                PID:4180
              • C:\Windows\SysWOW64\taskkill.exe
                TaskKill /F /IM 4484
                3⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2688
              • C:\Windows\SysWOW64\timeout.exe
                Timeout /T 2 /Nobreak
                3⤵
                • Delays execution with timeout.exe
                PID:2392
          • C:\Users\Admin\AppData\Local\Temp\build.exe
            "C:\Users\Admin\AppData\Local\Temp\build.exe"
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4476
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
            1⤵
              PID:580
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k UnistackSvcGroup
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3732

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmp856C.tmp.bat

              Filesize

              57B

              MD5

              36460a086817968f4a4924cf9862a7d5

              SHA1

              e4d9bd8c66c59128e919d7c799a9f1b5cabd63e1

              SHA256

              82f70785f17d0dce2388340c654067c247ce5b37aff0fa1eeb9181380aad9f1c

              SHA512

              10bc936392c487c8cfe0a6a481f80ddfaa7a79497296ee431b880ac829a11efe0df19fce2bfe8de366436b2d5436c32edccb666d4d8c4ecde0a2ab6b2b61cb71

            • C:\Users\Admin\AppData\Local\Temp\tmpBB8F.tmp.bat

              Filesize

              57B

              MD5

              5952ea205e38a6759603e9dfbfe89986

              SHA1

              bd5be120e84a4854e02ad5daa8749a3b2192e46b

              SHA256

              04f75331e9adb0502aae51a587ab7e88c82f92e20d9e79f5ae732c3ec438af87

              SHA512

              83fe6492544716237244bfa13d7053924180fb1b4ec8601acd3afee0b4de50d0268e49a59bbc72db84fa7fbe15680710745d852f3a69b90e6d4f88711e2e25bd

            • C:\Users\Admin\AppData\Local\Temp\tmpEEB5.tmp.bat

              Filesize

              57B

              MD5

              6e5b41c630ab9c0c86a5e5c85b86c179

              SHA1

              e3e7f2566a7eae1c102776fe1574088a1b61792c

              SHA256

              42176faa51a463301e85d84a80eda9ee765ba1aa1822004fd8933d7553f40f03

              SHA512

              94334e600871dd90c9e8dcbe0c0bbb326644405ef16dbd9023513bfdd976131c846392ceb6a7fc24b73bc1a1d09b83ac009b4c2fa74703d34b55220f5d827c0f

            • memory/2776-1-0x00000000743F0000-0x0000000074BA0000-memory.dmp

              Filesize

              7.7MB

            • memory/2776-2-0x0000000005650000-0x00000000056B6000-memory.dmp

              Filesize

              408KB

            • memory/2776-3-0x0000000005640000-0x0000000005650000-memory.dmp

              Filesize

              64KB

            • memory/2776-4-0x00000000743F0000-0x0000000074BA0000-memory.dmp

              Filesize

              7.7MB

            • memory/2776-7-0x00000000743F0000-0x0000000074BA0000-memory.dmp

              Filesize

              7.7MB

            • memory/2776-0-0x0000000000AF0000-0x0000000000C82000-memory.dmp

              Filesize

              1.6MB

            • memory/2960-14-0x0000000074490000-0x0000000074C40000-memory.dmp

              Filesize

              7.7MB

            • memory/2960-9-0x0000000005340000-0x0000000005350000-memory.dmp

              Filesize

              64KB

            • memory/2960-8-0x0000000074490000-0x0000000074C40000-memory.dmp

              Filesize

              7.7MB

            • memory/3732-23-0x000001B0FF140000-0x000001B0FF150000-memory.dmp

              Filesize

              64KB

            • memory/3732-59-0x000001B0FF670000-0x000001B0FF671000-memory.dmp

              Filesize

              4KB

            • memory/3732-58-0x000001B0FF560000-0x000001B0FF561000-memory.dmp

              Filesize

              4KB

            • memory/3732-57-0x000001B0FF560000-0x000001B0FF561000-memory.dmp

              Filesize

              4KB

            • memory/3732-55-0x000001B0FF530000-0x000001B0FF531000-memory.dmp

              Filesize

              4KB

            • memory/3732-39-0x000001B0FF240000-0x000001B0FF250000-memory.dmp

              Filesize

              64KB

            • memory/4476-19-0x0000000074490000-0x0000000074C40000-memory.dmp

              Filesize

              7.7MB

            • memory/4476-16-0x0000000074490000-0x0000000074C40000-memory.dmp

              Filesize

              7.7MB

            • memory/4484-22-0x0000000074490000-0x0000000074C40000-memory.dmp

              Filesize

              7.7MB

            • memory/4484-10-0x0000000074490000-0x0000000074C40000-memory.dmp

              Filesize

              7.7MB

            • memory/4484-17-0x0000000005160000-0x0000000005170000-memory.dmp

              Filesize

              64KB

            • memory/4484-15-0x0000000074490000-0x0000000074C40000-memory.dmp

              Filesize

              7.7MB

            • memory/4484-13-0x0000000005160000-0x0000000005170000-memory.dmp

              Filesize

              64KB