Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
30/01/2024, 04:04
General
- Target 0x0034000000015c70-970.exe
- Size 1.6MB
- Sample240130-em5deahddn
- SHA256 7bde84ef1142b6460f2818f5a3137c1cdc508148c875caf7a91ac69ae026f942
Malware Config
Extracted
-
stealerium
-
https://discordapp.com/api/webhooks/1197850806213431377/-zU9uA2NeaYEk4-ozdhgmNljI6NS_w_qcT_cbtxYxZdkUD3JeaKChZp4GXdod-MX3D1Q
Signatures
- Stealerium
An open source info stealer written in C# first seen in May 2022.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x0034000000015c70-970.exe"C:\Users\Admin\AppData\Local\Temp\0x0034000000015c70-970.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Bookmarks.txt
OneDrive.txt
Startup.txt
Videos.txt
Apps.txt
Debug.txt
Process.txt
ProductKey.txt
msgid.dat
memory/3436-7-0x0000000005340000-0x00000000053D2000-memory.dmp
memory/3436-12-0x00000000064B0000-0x00000000064CE000-memory.dmp
memory/3436-69-0x0000000006590000-0x0000000006622000-memory.dmp
memory/3436-74-0x00000000071E0000-0x0000000007784000-memory.dmp
memory/3436-8-0x00000000053D0000-0x00000000053F6000-memory.dmp
memory/3436-1-0x00000000748D0000-0x0000000075080000-memory.dmp
memory/3436-199-0x0000000004E20000-0x0000000004E30000-memory.dmp
memory/3436-202-0x0000000006500000-0x000000000657A000-memory.dmp
memory/3436-10-0x0000000006480000-0x000000000648A000-memory.dmp
memory/3436-3-0x0000000004E20000-0x0000000004E30000-memory.dmp
memory/3436-2-0x0000000004DB0000-0x0000000004E16000-memory.dmp
memory/3436-9-0x0000000005400000-0x0000000005408000-memory.dmp
memory/3436-0-0x0000000000410000-0x00000000005A2000-memory.dmp
memory/3436-275-0x0000000006910000-0x00000000069C2000-memory.dmp
memory/3436-277-0x0000000006740000-0x0000000006762000-memory.dmp
memory/3436-278-0x0000000007C00000-0x0000000007F54000-memory.dmp
memory/3436-280-0x00000000748D0000-0x0000000075080000-memory.dmp
memory/3436-11-0x0000000006490000-0x0000000006498000-memory.dmp
memory/3436-291-0x0000000006AB0000-0x0000000006ABA000-memory.dmp
memory/3436-292-0x0000000004E20000-0x0000000004E30000-memory.dmp
memory/3436-293-0x0000000004E20000-0x0000000004E30000-memory.dmp