Analysis
- max time kernel
299s - max time network
303s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system - submitted
02/03/2024, 05:00
Behavioral task
behavioral1
Sample
build.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
300 seconds
Behavioral task
behavioral2
Sample
build.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
300 seconds
Behavioral task
behavioral3
Sample
build.exe
Resource
win10-20240221-en
windows10-1703-x64
17 signatures
300 seconds
Behavioral task
behavioral4
Sample
build.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
300 seconds
Behavioral task
behavioral5
Sample
build.exe
Resource
win11-20240221-en
windows11-21h2-x64
12 signatures
300 seconds
General
- Target build.exe
- Size 1.6MB
- Sample240302-fnf8msah75
- SHA256 583fa788210692bc8b2cd5bd78661229278554d2d93467359adf0582de5ae589
- MD5 1140513f8e1c105500a6e034ffe66c40
- SHA1 09ab6fbb575e13f6fb2c094fde9e6a81f42c11e7
- SHA512 76a2f5539c5343fb3a41d4f0f2e100f73e128af5f1f9fbfc90e3cac07dbcb1290aca0e89c6dd5ac4a121d7ab4a2c6036fa0b3cdbd68fe6200fc191d9ad1749ef
- SSDEEP 49152:1kTq24GjdGSiqkqXfd+/9AqYanieKdsL:11EjdGSiqkqXf0FLYW
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
stealerium
C2
-
https://discord.com/api/webhooks/1213345894246776842/7_ATY4XD-iJBgrMTHRKnjaIQFy_kOGJVfH4b103xKnMpiWtIB0E1n4Fst7kmA2PLi3_w
Signatures
- Stealerium
An open source info stealer written in C# first seen in May 2022.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe Key opened \REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe Key opened \REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 1 discord.com 2 discord.com 24 discord.com - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 icanhazip.com - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 build.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier build.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4184 build.exe 4704 taskmgr.exe 4704 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4704 taskmgr.exe 4184 build.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4184 build.exe Token: SeSecurityPrivilege 4844 msiexec.exe Token: SeDebugPrivilege 4704 taskmgr.exe Token: SeSystemProfilePrivilege 4704 taskmgr.exe Token: SeCreateGlobalPrivilege 4704 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4184 build.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4184 wrote to memory of 2868 4184 build.exe 73 PID 4184 wrote to memory of 2868 4184 build.exe 73 PID 4184 wrote to memory of 2868 4184 build.exe 73 PID 2868 wrote to memory of 2512 2868 cmd.exe 75 PID 2868 wrote to memory of 2512 2868 cmd.exe 75 PID 2868 wrote to memory of 2512 2868 cmd.exe 75 PID 2868 wrote to memory of 3440 2868 cmd.exe 76 PID 2868 wrote to memory of 3440 2868 cmd.exe 76 PID 2868 wrote to memory of 3440 2868 cmd.exe 76 PID 2868 wrote to memory of 4124 2868 cmd.exe 77 PID 2868 wrote to memory of 4124 2868 cmd.exe 77 PID 2868 wrote to memory of 4124 2868 cmd.exe 77 PID 4184 wrote to memory of 3624 4184 build.exe 80 PID 4184 wrote to memory of 3624 4184 build.exe 80 PID 4184 wrote to memory of 3624 4184 build.exe 80 PID 3624 wrote to memory of 820 3624 cmd.exe 82 PID 3624 wrote to memory of 820 3624 cmd.exe 82 PID 3624 wrote to memory of 820 3624 cmd.exe 82 PID 3624 wrote to memory of 3808 3624 cmd.exe 83 PID 3624 wrote to memory of 3808 3624 cmd.exe 83 PID 3624 wrote to memory of 3808 3624 cmd.exe 83 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4184 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:2512
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵PID:3440
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵PID:4124
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:820
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵PID:3808
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\919fb9f2de6be345b9b5b9eec1c700c0\Admin@LIBGPSZH_en-US\Browsers\Firefox\Bookmarks.txt
- Size 105B
- SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
- MD5 2e9d094dda5cdc3ce6519f75943a4ff4
- SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
- SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\919fb9f2de6be345b9b5b9eec1c700c0\Admin@LIBGPSZH_en-US\Directories\OneDrive.txt
- Size 25B
- SHA256 8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
- MD5 966247eb3ee749e21597d73c4176bd52
- SHA1 1e9e63c2872cef8f015d4b888eb9f81b00a35c79
- SHA512 bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\919fb9f2de6be345b9b5b9eec1c700c0\Admin@LIBGPSZH_en-US\Directories\Startup.txt
- Size 24B
- SHA256 889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
- MD5 68c93da4981d591704cea7b71cebfb97
- SHA1 fd0f8d97463cd33892cc828b4ad04e03fc014fa6
- SHA512 63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\919fb9f2de6be345b9b5b9eec1c700c0\Admin@LIBGPSZH_en-US\Directories\Videos.txt
- Size 23B
- SHA256 a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
- MD5 1fddbf1169b6c75898b86e7e24bc7c1f
- SHA1 d2091060cb5191ff70eb99c0088c182e80c20f8c
- SHA512 20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\919fb9f2de6be345b9b5b9eec1c700c0\Admin@LIBGPSZH_en-US\System\Apps.txt
- Size 4KB
- SHA256 248244e8eb7eb84595cf35d69e166cc936e95317322d035ec7ad9270ad6b268f
- MD5 ee167dc7cf7d28aed57d3790f75c1428
- SHA1 a1df8eea5d515caf80f654a0f69bc0e1e719ccaf
- SHA512 ffd9e17c399b2ba4caf96e5838253eeee239f5bebfe957b5a9efc0733ff59715e3fc653d037271d90df7da3d30b0304ee6bc4cf08c0e7f898d3adc811d2551d2
- SSDEEP 96:OfpVX3fpVXPfpVmNpJfWQWEf4pKEf4DvufWbfFUSfFUaiRpqffJtrhffJS08cofP:wpV/pV3pVsWn24w24EW7msmkJLJJ8cCP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\919fb9f2de6be345b9b5b9eec1c700c0\Admin@LIBGPSZH_en-US\System\Debug.txt
- Size 293B
- SHA256 d29bb067b8e5fe5685007e72faa0c3c39ad6ea26b97d5bea8b603045fc6d2a22
- MD5 3257f87ce5f60779675fee3082153e70
- SHA1 91aa98b8644af072f8c37bf40cfd4427f0f8c41a
- SHA512 71b96714ee0d03c46dd9637c1feceb4a7246a49fa6046a0e0fc7091ac6a7dc607c84e5998e1120bf76fde975b686b0b24690c7c02d6892eefd7311d200098f86
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\919fb9f2de6be345b9b5b9eec1c700c0\Admin@LIBGPSZH_en-US\System\Process.txt
- Size 4KB
- SHA256 53592d0066f9cfba59681f85db055b006f2c8b9c8da2da102e16f81867233736
- MD5 bfc02f11394100d1e452307b388634ea
- SHA1 ec89a1b6ad131720e41ec74258032afeeed738d7
- SHA512 5ac518c95cee8621a4a88bbdc2e33540aa1d031713246ad1f3e634c685dd7454dc2f422043260cb28af67f77b33d6918cf584a37455709422e1a10e24396bd11
- SSDEEP 48:VWgSjp23jYqYBAeZbvuAu96BUju29BYmgxsL:Up23juDDRWMUywBYmgx+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\919fb9f2de6be345b9b5b9eec1c700c0\Admin@LIBGPSZH_en-US\System\ProductKey.txt
- Size 29B
- SHA256 f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
- MD5 71eb5479298c7afc6d126fa04d2a9bde
- SHA1 a9b3d5505cf9f84bb6c2be2acece53cb40075113
- SHA512 7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\919fb9f2de6be345b9b5b9eec1c700c0\msgid.dat
- Size 19B
- SHA256 cbc8e7c107efcc7d60f645abd84a1384cbd9fb4dcd44938726b160a1c89531cf
- MD5 f8bb2ba29b525b9b4b18ab989cd3cad3
- SHA1 a4ad9884988c0e04f0307311778ee088e46312c5
- SHA512 f00ded5da0696044e8ca676795929d64b197b75a0a57761ebca1ee15ef44369be16894c1fb946f0383aa177f48cdcd9e802997001e6b01712a43ed34debec63d
- MD5 SHA1 SHA512