Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
28-01-2024 22:40
Behavioral task
behavioral1
Sample
build.exe
Resource
win10-20231215-en
General
-
Target
build.exe
-
Size
1.6MB
-
MD5
250114fc325e32139aa68c458e697830
-
SHA1
af892053b7b94d33167e103dcd832aa066d68192
-
SHA256
55dcd1490fe7d1f7fb0ada01cc79b3e2b113ac16a5e8d09c926ccb399a0f2f49
-
SHA512
79e8c65a3d46409cdeb138b26c9b8d098131d0ad86eb17b5db67ec95525a8754765e75e2f2f29c37de7ec3af829eb774f239667aedbc00aef5869df34d0f52a9
-
SSDEEP
49152:7kTq24GjdGSiqkqXfd+/9AqYanieKdsE:71EjdGSiqkqXf0FLYW
Malware Config
Extracted
stealerium
https://discord.com/api/webhooks/1201288796562538517/o6-Ku-dNscXZhObTEtbm_lFKoJJYFvSFSt6SoCwEtsOVekRR7aaNTA4KxzGGcBqj_FIA
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
build.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe Key opened \REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe Key opened \REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 icanhazip.com -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 build.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier build.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
build.exepid process 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe 3148 build.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
build.exemsiexec.exedescription pid process Token: SeDebugPrivilege 3148 build.exe Token: SeSecurityPrivilege 3576 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
build.exepid process 3148 build.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
build.execmd.execmd.exedescription pid process target process PID 3148 wrote to memory of 5032 3148 build.exe cmd.exe PID 3148 wrote to memory of 5032 3148 build.exe cmd.exe PID 3148 wrote to memory of 5032 3148 build.exe cmd.exe PID 5032 wrote to memory of 3144 5032 cmd.exe chcp.com PID 5032 wrote to memory of 3144 5032 cmd.exe chcp.com PID 5032 wrote to memory of 3144 5032 cmd.exe chcp.com PID 5032 wrote to memory of 5088 5032 cmd.exe netsh.exe PID 5032 wrote to memory of 5088 5032 cmd.exe netsh.exe PID 5032 wrote to memory of 5088 5032 cmd.exe netsh.exe PID 5032 wrote to memory of 3132 5032 cmd.exe findstr.exe PID 5032 wrote to memory of 3132 5032 cmd.exe findstr.exe PID 5032 wrote to memory of 3132 5032 cmd.exe findstr.exe PID 3148 wrote to memory of 2680 3148 build.exe cmd.exe PID 3148 wrote to memory of 2680 3148 build.exe cmd.exe PID 3148 wrote to memory of 2680 3148 build.exe cmd.exe PID 2680 wrote to memory of 1732 2680 cmd.exe chcp.com PID 2680 wrote to memory of 1732 2680 cmd.exe chcp.com PID 2680 wrote to memory of 1732 2680 cmd.exe chcp.com PID 2680 wrote to memory of 4508 2680 cmd.exe netsh.exe PID 2680 wrote to memory of 4508 2680 cmd.exe netsh.exe PID 2680 wrote to memory of 4508 2680 cmd.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
build.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe -
outlook_win_path 1 IoCs
Processes:
build.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2595843030-3811137303-3031389247-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3148 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:3144
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵PID:3132
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵PID:5088
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:1732
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵PID:4508
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\06c89a3f794608476df477732a4003e3\Admin@NGBMWCIY_en-US\Browsers\Firefox\Bookmarks.txt
Filesize105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Local\06c89a3f794608476df477732a4003e3\Admin@NGBMWCIY_en-US\Directories\OneDrive.txt
Filesize25B
MD5966247eb3ee749e21597d73c4176bd52
SHA11e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA2568ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
SHA512bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
-
C:\Users\Admin\AppData\Local\06c89a3f794608476df477732a4003e3\Admin@NGBMWCIY_en-US\Directories\Startup.txt
Filesize24B
MD568c93da4981d591704cea7b71cebfb97
SHA1fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA256889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
SHA51263455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
-
C:\Users\Admin\AppData\Local\06c89a3f794608476df477732a4003e3\Admin@NGBMWCIY_en-US\Directories\Videos.txt
Filesize23B
MD51fddbf1169b6c75898b86e7e24bc7c1f
SHA1d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA256a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
SHA51220bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
-
Filesize
4KB
MD526d9f9a2a9446c14bf64d28289945b28
SHA134a66ba4a07194c8bba99964df1dc0e61996afb4
SHA256b2b9a40214040e248a11e4b5d9cd8f45d759434a57acdd0a70f70fef95fa7124
SHA5124e38a4a7f5598ecd4aa233749005936c16cb5fc0e0465c4be12bea37e961825c44b07aa2811e321f4dc56bef6a2d7900aab904300d9ed5cf6f6427c8784bafdd
-
Filesize
1KB
MD535d21a27e2f381f14fc55cf32a27233c
SHA11643fe84a23dc8b3321c121dc57820607e97aa82
SHA256420f90eae4d9cdc784828e06122a005c31b4cd58be9e514da7f24a68ad0b9c74
SHA512464ef7b05e00f25942de3bfe092fc90be6f96193de200089d92c4c30abf4d0aef086e82d40d9187244e02977ff6d0147f916f7d2ca258ff4faca2dc1f299357d
-
C:\Users\Admin\AppData\Local\06c89a3f794608476df477732a4003e3\Admin@NGBMWCIY_en-US\System\Process.txt
Filesize4KB
MD56ad09a68061fe6c006b925669cf4b139
SHA12c5adb0fb5918b688b8fb4f21d384e4bb45f81a7
SHA256af7de6b871d95011680db18e0c3a40afb8ccacde5a0ffb301bde7d116b99b4b5
SHA512c6ee7fee697b19b675fce2d41dd612cd513e2511fbf7f1b2f552b57b462fbbc41896cad01eee2ccd966cd86d47765607281d39a3b8499b9c7da4d8c2dedb2310
-
C:\Users\Admin\AppData\Local\06c89a3f794608476df477732a4003e3\Admin@NGBMWCIY_en-US\System\ProductKey.txt
Filesize29B
MD571eb5479298c7afc6d126fa04d2a9bde
SHA1a9b3d5505cf9f84bb6c2be2acece53cb40075113
SHA256f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
SHA5127c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd
-
Filesize
19B
MD5d3c95d5eedf09ce409c4b5da5c18a9c8
SHA181280bc07fefbf482970701d7f6c9a4786b0e5b2
SHA2560ab1d4a3151465dfd385fb065ade21fdf7539c73286e367b39d83905877ce763
SHA51292e4a952ac9f114e32ef41906e83f5d59b52b93d399e0aefe2a6e548bcd2703d31ee2c13db9fd68d5a0462629b9a6dd8d78680fce73fae08bdbd484b258a8215