Analysis

  • max time kernel
    1152s
  • max time network
    1158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-01-2024 13:02

General

  • Target

    McGen.exe

  • Size

    1.6MB

  • MD5

    a4c1bfcfe56368de9ffb5ca2a6e81b7e

  • SHA1

    ae5a6aef9100da3d9aee2b0e762382094e0c879e

  • SHA256

    2a0f9a08fc9b79e28ff8c527eaee816b12c24ff947f781ed049d5ea0408f885d

  • SHA512

    32cbd44f3600fa50f4424753a49f48ae04057c099c9442ba4217faac3f907b9400dc26a56bbd95297a5295982914f6fa0897a5a789fe32575d977fb9ccfda336

  • SSDEEP

    49152:1kTq24GjdGSiqkqXfd+/9AqYanieKds+d:11EjdGSiqkqXf0FLYW

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1197224341901938759/wLjyGgVEBqObJK1n6Mhygan_HAFt4E4fZuNMoRr9wTg9rwDHYI2JTbhPys_V3v5lHtnq

Signatures

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\McGen.exe
    "C:\Users\Admin\AppData\Local\Temp\McGen.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:2752
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4416
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:4424
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show profile
          3⤵
            PID:1924
          • C:\Windows\SysWOW64\findstr.exe
            findstr All
            3⤵
              PID:208
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4912
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              3⤵
                PID:3928
              • C:\Windows\SysWOW64\netsh.exe
                netsh wlan show networks mode=bssid
                3⤵
                  PID:4580
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 2880
                2⤵
                • Program crash
                PID:4112
            • C:\Windows\system32\msiexec.exe
              C:\Windows\system32\msiexec.exe /V
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2084
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2752 -ip 2752
              1⤵
                PID:4452

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\4137727a0010564184984e3a28128ef6\Admin@NUPNSVML_en-US\Browsers\Firefox\Bookmarks.txt

                Filesize

                105B

                MD5

                2e9d094dda5cdc3ce6519f75943a4ff4

                SHA1

                5d989b4ac8b699781681fe75ed9ef98191a5096c

                SHA256

                c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                SHA512

                d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

              • C:\Users\Admin\AppData\Local\4137727a0010564184984e3a28128ef6\Admin@NUPNSVML_en-US\Directories\OneDrive.txt

                Filesize

                25B

                MD5

                966247eb3ee749e21597d73c4176bd52

                SHA1

                1e9e63c2872cef8f015d4b888eb9f81b00a35c79

                SHA256

                8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

                SHA512

                bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

              • C:\Users\Admin\AppData\Local\4137727a0010564184984e3a28128ef6\Admin@NUPNSVML_en-US\Directories\Startup.txt

                Filesize

                24B

                MD5

                68c93da4981d591704cea7b71cebfb97

                SHA1

                fd0f8d97463cd33892cc828b4ad04e03fc014fa6

                SHA256

                889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

                SHA512

                63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

              • C:\Users\Admin\AppData\Local\4137727a0010564184984e3a28128ef6\Admin@NUPNSVML_en-US\Directories\Videos.txt

                Filesize

                23B

                MD5

                1fddbf1169b6c75898b86e7e24bc7c1f

                SHA1

                d2091060cb5191ff70eb99c0088c182e80c20f8c

                SHA256

                a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

                SHA512

                20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

              • C:\Users\Admin\AppData\Local\4137727a0010564184984e3a28128ef6\Admin@NUPNSVML_en-US\System\Apps.txt

                Filesize

                5KB

                MD5

                ccb3292aef4fc57ea4e5cc2e4fe192a2

                SHA1

                7a064cf87352ac7554b86c9e42c0072972aad656

                SHA256

                3ce45cd6bc49282884ec7cb1f74eb1eb8b2663990b8d75d5e57cee9a4f6b4886

                SHA512

                9ffc6e6c7958600e8149c4ae7375ec35845db47ddde311371ac42c9d4b605bb5a02325f903a461c87bf628c3e972a3882c0637df319dd798734eed8e27e74d1f

              • C:\Users\Admin\AppData\Local\4137727a0010564184984e3a28128ef6\Admin@NUPNSVML_en-US\System\Debug.txt

                Filesize

                293B

                MD5

                68723649be1a75782270045ed211eaff

                SHA1

                ced6d69b6c444dfe300657c83e6b4d5fb2812706

                SHA256

                492e6bd7b4102ac23964c003acc415c8a08bf6c71b041d89493316f00cc2b6d2

                SHA512

                722f9f8222c70a3944b9acec9556402ba30ad66f5b47188f7d9853108ced89cbffa4631c77adabc09629934678aabcbea6ddb0e8d46c7afde01182cdc646452e

              • C:\Users\Admin\AppData\Local\4137727a0010564184984e3a28128ef6\Admin@NUPNSVML_en-US\System\Process.txt

                Filesize

                4KB

                MD5

                644d74dc037f938e840501648237de2e

                SHA1

                94355a0d663ce6fc6b8847c7ea5cef2eb37e93b2

                SHA256

                170dfbd1059b20b3bb9615a661f20396e7ceba4e10e99b191bfd12cbdb0c7073

                SHA512

                58ca7b9a9333662609cb461b696f6df20bc14a4ca801b44ee6b5bfef70226d78f18c4148b51eb680bd9db1250b76aa3ab161811c969b04348789861af4fd66a1

              • C:\Users\Admin\AppData\Local\4137727a0010564184984e3a28128ef6\Admin@NUPNSVML_en-US\System\ProductKey.txt

                Filesize

                29B

                MD5

                71eb5479298c7afc6d126fa04d2a9bde

                SHA1

                a9b3d5505cf9f84bb6c2be2acece53cb40075113

                SHA256

                f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

                SHA512

                7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

              • memory/2752-9-0x0000000003120000-0x0000000003128000-memory.dmp

                Filesize

                32KB

              • memory/2752-202-0x00000000061D0000-0x000000000624A000-memory.dmp

                Filesize

                488KB

              • memory/2752-12-0x0000000006D10000-0x0000000006D2E000-memory.dmp

                Filesize

                120KB

              • memory/2752-41-0x0000000008640000-0x00000000086D2000-memory.dmp

                Filesize

                584KB

              • memory/2752-10-0x00000000062B0000-0x00000000062BA000-memory.dmp

                Filesize

                40KB

              • memory/2752-0-0x0000000074FF0000-0x00000000757A0000-memory.dmp

                Filesize

                7.7MB

              • memory/2752-77-0x0000000008C90000-0x0000000009234000-memory.dmp

                Filesize

                5.6MB

              • memory/2752-114-0x0000000005760000-0x0000000005770000-memory.dmp

                Filesize

                64KB

              • memory/2752-8-0x0000000005C70000-0x0000000005C96000-memory.dmp

                Filesize

                152KB

              • memory/2752-167-0x0000000005760000-0x0000000005770000-memory.dmp

                Filesize

                64KB

              • memory/2752-7-0x0000000005BE0000-0x0000000005C72000-memory.dmp

                Filesize

                584KB

              • memory/2752-11-0x00000000062C0000-0x00000000062C8000-memory.dmp

                Filesize

                32KB

              • memory/2752-4-0x0000000005760000-0x0000000005770000-memory.dmp

                Filesize

                64KB

              • memory/2752-3-0x0000000074FF0000-0x00000000757A0000-memory.dmp

                Filesize

                7.7MB

              • memory/2752-2-0x0000000005690000-0x00000000056F6000-memory.dmp

                Filesize

                408KB

              • memory/2752-1-0x0000000000B20000-0x0000000000CB2000-memory.dmp

                Filesize

                1.6MB

              • memory/2752-275-0x0000000007520000-0x00000000075D2000-memory.dmp

                Filesize

                712KB

              • memory/2752-277-0x00000000075D0000-0x00000000075F2000-memory.dmp

                Filesize

                136KB

              • memory/2752-278-0x0000000007B50000-0x0000000007EA4000-memory.dmp

                Filesize

                3.3MB

              • memory/2752-279-0x0000000005760000-0x0000000005770000-memory.dmp

                Filesize

                64KB

              • memory/2752-280-0x0000000074FF0000-0x00000000757A0000-memory.dmp

                Filesize

                7.7MB