Overview
overview
10Static
static
10Stealerium.zip
windows11-21h2-x64
1Builder.deps.json
windows11-21h2-x64
3Builder.exe
windows11-21h2-x64
1Builder.exe
windows11-21h2-x64
1Builder.pdb
windows11-21h2-x64
3Builder.ru...g.json
windows11-21h2-x64
3Mono.Cecil.Mdb.dll
windows11-21h2-x64
1Mono.Cecil.Pdb.dll
windows11-21h2-x64
1Mono.Cecil.Rocks.dll
windows11-21h2-x64
1Mono.Cecil.dll
windows11-21h2-x64
1SixLabors....rp.dll
windows11-21h2-x64
1Spectre.Co...rp.dll
windows11-21h2-x64
1Spectre.Console.dll
windows11-21h2-x64
1Stub/stub.exe
windows11-21h2-x64
10Stub/stub.exe.config
windows11-21h2-x64
3Analysis
- max time kernel
85s - max time network
88s - platform
windows11-21h2_x64 - resource
win11-20231215-en - resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system - submitted
04/02/2024, 08:14
Behavioral task
behavioral1
Sample
Stealerium.zip
Resource
win11-20231215-en
Behavioral task
behavioral2
Sample
Builder.deps.json
Resource
win11-20231215-en
Behavioral task
behavioral3
Sample
Builder.exe
Resource
win11-20231222-en
Behavioral task
behavioral4
Sample
Builder.exe
Resource
win11-20231215-en
Behavioral task
behavioral5
Sample
Builder.pdb
Resource
win11-20231215-en
Behavioral task
behavioral6
Sample
Builder.runtimeconfig.json
Resource
win11-20231215-en
Behavioral task
behavioral7
Sample
Mono.Cecil.Mdb.dll
Resource
win11-20231215-en
Behavioral task
behavioral8
Sample
Mono.Cecil.Pdb.dll
Resource
win11-20231215-en
Behavioral task
behavioral9
Sample
Mono.Cecil.Rocks.dll
Resource
win11-20231215-en
Behavioral task
behavioral10
Sample
Mono.Cecil.dll
Resource
win11-20231215-en
Behavioral task
behavioral11
Sample
SixLabors.ImageSharp.dll
Resource
win11-20231215-en
Behavioral task
behavioral12
Sample
Spectre.Console.ImageSharp.dll
Resource
win11-20231222-en
Behavioral task
behavioral13
Sample
Spectre.Console.dll
Resource
win11-20231215-en
Behavioral task
behavioral14
Sample
Stub/stub.exe
Resource
win11-20231215-en
Behavioral task
behavioral15
Sample
Stub/stub.exe.config
Resource
win11-20231222-en
General
- Target Builder.deps.json
- Size 5KB
- Sample240204-j47bjsdag8
- SHA256 d6a04809c3737f76818082a2caf9b80ac7f0e14bc73b2fabdea2df46d9e25a52
- MD5 d41bff259e1ebb625fc788fa681377ad
- SHA1 b5c8b7725d6f885db30e9237682abfec72aa65be
- SHA512 8aaed8b1b2e40c5a631753789fcf34dadf95a4aab29f852a98ecb3dc30dc5c1df11d69081fb17282c78e0310e65567ab7339bc58efba6fc7b6f729f31fc040e3
- SSDEEP 48:nC00u5rEsIXhpXhNXh3JX178dOmuOWhTV7H+qLSYHByD3cHIco3aHEg3HwHf1LHL:YuNEHx7HLSYgD3cIKkQQcsB1vd
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4988 OpenWith.exe