stealerium | 765ddbbff5fc687fe0ad871a9cf59eaec452f00cdcac803f6c41c7feab5d0d2b

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2024, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
765ddbbff5fc687fe0ad871a9cf59eaec452f00cdcac803f6c41c7feab5d0d2b.exe
Size 3.6MB
Sample240207-zyjw3acegr
SHA256 765ddbbff5fc687fe0ad871a9cf59eaec452f00cdcac803f6c41c7feab5d0d2b
MD5 308d26166b4569b7323c948b02f170b2
SHA1 577b0a2f93528b95e652136de2ccb13e5c34b95e
SHA512 cc759d4cc247f13a3c9cbd422df112cd54b3f2414ed176a3a3aa8959865db8f48040687f45d4886112d7a29e8d7f32179e09aa8d801fd5d29b3be6ce474ebb51
SSDEEP 98304:CmVIHeB8VJs21gujnXQNIX7ssksC5K89D:YVHtjXQcssksV8D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealerium stealer

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/1200397280960852070/TExZuN0MKj2BsfGJDc7F-9qVK-4LYeYTCfFyUmiHYwAhJM4GNuQVTLJTnDPT4xQdIWCc

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/memory/4960-20-0x000000001BB00000-0x000000001BC94000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/memory/4960-20-0x000000001BB00000-0x000000001BC94000-memory.dmp	INDICATOR_EXE_Packed_Fody

Detects executables referencing Discord tokens regular expressions 1 IoCs

resource	yara_rule
behavioral2/memory/4960-20-0x000000001BB00000-0x000000001BC94000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex

Detects executables referencing credit card regular expressions 1 IoCs

resource	yara_rule
behavioral2/memory/4960-20-0x000000001BB00000-0x000000001BC94000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex

Detects executables referencing many VPN software clients. Observed in infosteslers 1 IoCs

resource	yara_rule
behavioral2/memory/4960-20-0x000000001BB00000-0x000000001BC94000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_VPN

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4960-20-0x000000001BB00000-0x000000001BC94000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4960-20-0x000000001BB00000-0x000000001BC94000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables with interest in wireless interface using netsh 1 IoCs

resource	yara_rule
behavioral2/memory/4960-20-0x000000001BB00000-0x000000001BC94000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_WirelessNetReccon

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	765ddbbff5fc687fe0ad871a9cf59eaec452f00cdcac803f6c41c7feab5d0d2b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	Svhost.exe

Executes dropped EXE 2 IoCs

pid	Process
4960	Svhost.exe
3520	cs2-external.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
16	discord.com
17	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3916	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4428	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4960	Svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	Svhost.exe
Token: SeDebugPrivilege	4428	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 4960	2608	765ddbbff5fc687fe0ad871a9cf59eaec452f00cdcac803f6c41c7feab5d0d2b.exe	85
PID 2608 wrote to memory of 4960	2608	765ddbbff5fc687fe0ad871a9cf59eaec452f00cdcac803f6c41c7feab5d0d2b.exe	85
PID 2608 wrote to memory of 3520	2608	765ddbbff5fc687fe0ad871a9cf59eaec452f00cdcac803f6c41c7feab5d0d2b.exe	87
PID 2608 wrote to memory of 3520	2608	765ddbbff5fc687fe0ad871a9cf59eaec452f00cdcac803f6c41c7feab5d0d2b.exe	87
PID 4960 wrote to memory of 1632	4960	Svhost.exe	94
PID 4960 wrote to memory of 1632	4960	Svhost.exe	94
PID 1632 wrote to memory of 3952	1632	cmd.exe	95
PID 1632 wrote to memory of 3952	1632	cmd.exe	95
PID 1632 wrote to memory of 4428	1632	cmd.exe	96
PID 1632 wrote to memory of 4428	1632	cmd.exe	96
PID 1632 wrote to memory of 3916	1632	cmd.exe	97
PID 1632 wrote to memory of 3916	1632	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\765ddbbff5fc687fe0ad871a9cf59eaec452f00cdcac803f6c41c7feab5d0d2b.exe
"C:\Users\Admin\AppData\Local\Temp\765ddbbff5fc687fe0ad871a9cf59eaec452f00cdcac803f6c41c7feab5d0d2b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\Svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\Svhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp757E.tmp.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3952
  - - C:\Windows\system32\taskkill.exe
      TaskKill /F /IM 4960
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4428
  - - C:\Windows\system32\timeout.exe
      Timeout /T 2 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3916
- C:\Users\Admin\AppData\Local\Temp\cs2-external.exe
  "C:\Users\Admin\AppData\Local\Temp\cs2-external.exe"
  2⤵
  - Executes dropped EXE
  PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\Svhost.exe
Size 1.3MB
SHA256 481948a5e91a3e0fb868237e3e747ce3c8b22f4579357a6a3c7170a6dc1327b3
MD5 f5bac693c7c0a5f98bdbd12cf3930dff
SHA1 0afc9b47f3e9d985fe7b0a07d21342f419dd6b24
SHA512 5de41650ab647c76bd5117a08895fffa6b639ccc9065cf19324706821fe87b843965eff6aa27f30c65b343c56d31b61331fa563a1585740cd48d8a2bd60d87fa
SSDEEP 24576:laNaMS5R4W0XvDVEZHrpviX8BpTivQ5ZIfz451r:ENCaSZLpvo8/Rafz4b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\Svhost.exe
Size 1.6MB
SHA256 9a86e86d2cb885c7a420e0255ef7e35b0cbffed9625f13a0a94fea05d5b7a326
MD5 2fae86ec84c642bc8ce6460aea27d4e1
SHA1 32e2e926c081055fe0aa07fd76b71395103a904c
SHA512 a3d2a50b57f9a69ad1d4c637d9f274064443b06d4c4177be28b0f51d709743761e8ae1f2e14af885106af0865bf83047525448602b84b87dcda430a6ebc21c7d
SSDEEP 24576:laNaMS5R4W0XvDVEZHrpviX8BpTivQ5ZIfz451FgZR9i9PzasJ:ENCaSZLpvo8/Rafz410Rs9bJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cs2-external.exe

Path C:\Users\Admin\AppData\Local\Temp\cs2-external.exe
Size 1.2MB
SHA256 dece35f4551b1ff6307f1a9b5674b40dabb288c0cb9d163830af993755f46c44
MD5 12ee19340ae8fc416d1f2a91ef076947
SHA1 d29e9477b49126f26e0ad66aaf91df09197a204d
SHA512 1920a19ca183a3ecf2897b12906267e38ac67c5eee68938109eef53862f78040c557489093cb3cad48268ae78fa1268d119a093b32bbfa76773c4f0129414577
SSDEEP 24576:TJlqEf/mH0i7WXUR+zjmhwiAE2tOueHpANUgV6Z0XtO/k4+f/aCJ:TJ9E0sEU6mhwBEzxHdUO6f/D
MD5 SHA1 SHA512 SSDEEP

Submit Download

cs2-external.exe

Path C:\Users\Admin\AppData\Local\Temp\cs2-external.exe
Size 1.2MB
SHA256 6015d439a2ae498440a23bc9914e057562968eec3e87330de13e406b74b90f50
MD5 0469bbea0a5d63ba3b2f85eb96079c33
SHA1 dc4bd88b0f45f988313e3a402f5835d535dc7c8c
SHA512 5c1e556236f4939198ddd0bf75c0a122546abf628bc35dda43f78967d7e10392bd87abdb06a1098717712265ea38903168647b99324932aa09fc46af405858a0
SSDEEP 24576:TJlqEf/mH0i7WXUR+zjmhwiAE2tOueHpANUgV6Z0XtO/k4+f/aCgO:TJ9E0sEU6mhwBEzxHdUO6f/T
MD5 SHA1 SHA512 SSDEEP

Submit Download

cs2-external.exe

Path C:\Users\Admin\AppData\Local\Temp\cs2-external.exe
Size 1.5MB
SHA256 a483b9c3e029588d24330f3ad0f4fcb61c63822faa64d956f49784992fe37407
MD5 f9f754abde7fd61a83a412a2e255140b
SHA1 b4d26a28f1fdd11d40c9761b80831803d60b1476
SHA512 d1b1482a3a45fab148e6fd5a48cb02164fafe323d2b0c512c717b6778e5a584f8ffc7fb01f129cf27681a51968ab2be5ce127fe75b3e2d7594aa9ae2ac035f1d
SSDEEP 24576:TJlqEf/mH0i7WXUR+zjmhwiAE2tOueHpANUgV6Z0XtO/k4+f/aCgh7zA936wYQc7:TJ9E0sEU6mhwBEzxHdUO6f/0zArYQcmM
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp757E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp757E.tmp.bat
Size 57B
SHA256 f96b0e91ae86e79f2eb030d0d15b9ea0f16b2d2169851a5a57eb5c54727b94c4
MD5 71b71bf33339197c0c5007526a3d5aba
SHA1 52be5c8ec1ca0486d703388ef0f69edb7107b2f7
SHA512 abe09a701897ba6eecb5575c89f9a29809fa2c47f3f3071596a4837fcbbc66e56dcedb364163fdc3f71e4df5a601eb922abdbef8de65ffa364ba8a21dab280b9
MD5 SHA1 SHA512

Submit Download

memory/4960-20-0x000000001BB00000-0x000000001BC94000-memory.dmp

Download

memory/4960-21-0x000000001BAF0000-0x000000001BB00000-memory.dmp

Download

memory/4960-19-0x00007FF8607C0000-0x00007FF861281000-memory.dmp

Download

memory/4960-23-0x000000001B920000-0x000000001B9B2000-memory.dmp

Download

memory/4960-25-0x0000000003130000-0x0000000003138000-memory.dmp

Download

memory/4960-24-0x000000001B9B0000-0x000000001B9D6000-memory.dmp

Download

memory/4960-18-0x0000000000C60000-0x0000000000DF6000-memory.dmp

Download

memory/4960-28-0x00007FF8607C0000-0x00007FF861281000-memory.dmp

Download