Analysis
-
max time kernel
1152s -
max time network
1158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24-01-2024 13:02
Behavioral task
behavioral1
Sample
McGen.exe
Resource
win10v2004-20231215-en
General
-
Target
McGen.exe
-
Size
1.6MB
-
MD5
a4c1bfcfe56368de9ffb5ca2a6e81b7e
-
SHA1
ae5a6aef9100da3d9aee2b0e762382094e0c879e
-
SHA256
2a0f9a08fc9b79e28ff8c527eaee816b12c24ff947f781ed049d5ea0408f885d
-
SHA512
32cbd44f3600fa50f4424753a49f48ae04057c099c9442ba4217faac3f907b9400dc26a56bbd95297a5295982914f6fa0897a5a789fe32575d977fb9ccfda336
-
SSDEEP
49152:1kTq24GjdGSiqkqXfd+/9AqYanieKds+d:11EjdGSiqkqXf0FLYW
Malware Config
Extracted
stealerium
https://discord.com/api/webhooks/1197224341901938759/wLjyGgVEBqObJK1n6Mhygan_HAFt4E4fZuNMoRr9wTg9rwDHYI2JTbhPys_V3v5lHtnq
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
McGen.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 McGen.exe Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 McGen.exe Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 McGen.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 44 icanhazip.com -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4112 2752 WerFault.exe McGen.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
McGen.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 McGen.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier McGen.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
McGen.exepid process 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe 2752 McGen.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
McGen.exemsiexec.exedescription pid process Token: SeDebugPrivilege 2752 McGen.exe Token: SeSecurityPrivilege 2084 msiexec.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
McGen.execmd.execmd.exedescription pid process target process PID 2752 wrote to memory of 4416 2752 McGen.exe cmd.exe PID 2752 wrote to memory of 4416 2752 McGen.exe cmd.exe PID 2752 wrote to memory of 4416 2752 McGen.exe cmd.exe PID 4416 wrote to memory of 4424 4416 cmd.exe chcp.com PID 4416 wrote to memory of 4424 4416 cmd.exe chcp.com PID 4416 wrote to memory of 4424 4416 cmd.exe chcp.com PID 4416 wrote to memory of 1924 4416 cmd.exe netsh.exe PID 4416 wrote to memory of 1924 4416 cmd.exe netsh.exe PID 4416 wrote to memory of 1924 4416 cmd.exe netsh.exe PID 4416 wrote to memory of 208 4416 cmd.exe findstr.exe PID 4416 wrote to memory of 208 4416 cmd.exe findstr.exe PID 4416 wrote to memory of 208 4416 cmd.exe findstr.exe PID 2752 wrote to memory of 4912 2752 McGen.exe cmd.exe PID 2752 wrote to memory of 4912 2752 McGen.exe cmd.exe PID 2752 wrote to memory of 4912 2752 McGen.exe cmd.exe PID 4912 wrote to memory of 3928 4912 cmd.exe chcp.com PID 4912 wrote to memory of 3928 4912 cmd.exe chcp.com PID 4912 wrote to memory of 3928 4912 cmd.exe chcp.com PID 4912 wrote to memory of 4580 4912 cmd.exe netsh.exe PID 4912 wrote to memory of 4580 4912 cmd.exe netsh.exe PID 4912 wrote to memory of 4580 4912 cmd.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
McGen.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 McGen.exe -
outlook_win_path 1 IoCs
Processes:
McGen.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 McGen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\McGen.exe"C:\Users\Admin\AppData\Local\Temp\McGen.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2752 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:4424
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵PID:1924
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵PID:208
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:3928
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵PID:4580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 28802⤵
- Program crash
PID:4112
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2752 -ip 27521⤵PID:4452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\4137727a0010564184984e3a28128ef6\Admin@NUPNSVML_en-US\Browsers\Firefox\Bookmarks.txt
Filesize105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Local\4137727a0010564184984e3a28128ef6\Admin@NUPNSVML_en-US\Directories\OneDrive.txt
Filesize25B
MD5966247eb3ee749e21597d73c4176bd52
SHA11e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA2568ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
SHA512bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
-
C:\Users\Admin\AppData\Local\4137727a0010564184984e3a28128ef6\Admin@NUPNSVML_en-US\Directories\Startup.txt
Filesize24B
MD568c93da4981d591704cea7b71cebfb97
SHA1fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA256889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
SHA51263455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
-
C:\Users\Admin\AppData\Local\4137727a0010564184984e3a28128ef6\Admin@NUPNSVML_en-US\Directories\Videos.txt
Filesize23B
MD51fddbf1169b6c75898b86e7e24bc7c1f
SHA1d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA256a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
SHA51220bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
-
Filesize
5KB
MD5ccb3292aef4fc57ea4e5cc2e4fe192a2
SHA17a064cf87352ac7554b86c9e42c0072972aad656
SHA2563ce45cd6bc49282884ec7cb1f74eb1eb8b2663990b8d75d5e57cee9a4f6b4886
SHA5129ffc6e6c7958600e8149c4ae7375ec35845db47ddde311371ac42c9d4b605bb5a02325f903a461c87bf628c3e972a3882c0637df319dd798734eed8e27e74d1f
-
Filesize
293B
MD568723649be1a75782270045ed211eaff
SHA1ced6d69b6c444dfe300657c83e6b4d5fb2812706
SHA256492e6bd7b4102ac23964c003acc415c8a08bf6c71b041d89493316f00cc2b6d2
SHA512722f9f8222c70a3944b9acec9556402ba30ad66f5b47188f7d9853108ced89cbffa4631c77adabc09629934678aabcbea6ddb0e8d46c7afde01182cdc646452e
-
C:\Users\Admin\AppData\Local\4137727a0010564184984e3a28128ef6\Admin@NUPNSVML_en-US\System\Process.txt
Filesize4KB
MD5644d74dc037f938e840501648237de2e
SHA194355a0d663ce6fc6b8847c7ea5cef2eb37e93b2
SHA256170dfbd1059b20b3bb9615a661f20396e7ceba4e10e99b191bfd12cbdb0c7073
SHA51258ca7b9a9333662609cb461b696f6df20bc14a4ca801b44ee6b5bfef70226d78f18c4148b51eb680bd9db1250b76aa3ab161811c969b04348789861af4fd66a1
-
C:\Users\Admin\AppData\Local\4137727a0010564184984e3a28128ef6\Admin@NUPNSVML_en-US\System\ProductKey.txt
Filesize29B
MD571eb5479298c7afc6d126fa04d2a9bde
SHA1a9b3d5505cf9f84bb6c2be2acece53cb40075113
SHA256f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
SHA5127c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd