stealerium | 583fa788210692bc8b2cd5bd78661229278554d2d93467359adf0582de5ae589

Analysis

max time kernel
303s
max time network
275s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build.exe
Size 1.6MB
Sample240302-fnf8msah75
SHA256 583fa788210692bc8b2cd5bd78661229278554d2d93467359adf0582de5ae589
MD5 1140513f8e1c105500a6e034ffe66c40
SHA1 09ab6fbb575e13f6fb2c094fde9e6a81f42c11e7
SHA512 76a2f5539c5343fb3a41d4f0f2e100f73e128af5f1f9fbfc90e3cac07dbcb1290aca0e89c6dd5ac4a121d7ab4a2c6036fa0b3cdbd68fe6200fc191d9ad1749ef
SSDEEP 49152:1kTq24GjdGSiqkqXfd+/9AqYanieKdsL:11EjdGSiqkqXf0FLYW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealerium collection spyware stealer

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/1213345894246776842/7_ATY4XD-iJBgrMTHRKnjaIQFy_kOGJVfH4b103xKnMpiWtIB0E1n4Fst7kmA2PLi3_w

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe
Key opened	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe
Key opened	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
26	discord.com
27	discord.com
40	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	icanhazip.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	build.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe
1556	build.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1556	build.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	build.exe
Token: SeSecurityPrivilege	4172	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1556	build.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1992	1556	build.exe	92
PID 1556 wrote to memory of 1992	1556	build.exe	92
PID 1556 wrote to memory of 1992	1556	build.exe	92
PID 1992 wrote to memory of 2768	1992	cmd.exe	94
PID 1992 wrote to memory of 2768	1992	cmd.exe	94
PID 1992 wrote to memory of 2768	1992	cmd.exe	94
PID 1992 wrote to memory of 3792	1992	cmd.exe	95
PID 1992 wrote to memory of 3792	1992	cmd.exe	95
PID 1992 wrote to memory of 3792	1992	cmd.exe	95
PID 1992 wrote to memory of 2328	1992	cmd.exe	96
PID 1992 wrote to memory of 2328	1992	cmd.exe	96
PID 1992 wrote to memory of 2328	1992	cmd.exe	96
PID 1556 wrote to memory of 2512	1556	build.exe	99
PID 1556 wrote to memory of 2512	1556	build.exe	99
PID 1556 wrote to memory of 2512	1556	build.exe	99
PID 2512 wrote to memory of 4668	2512	cmd.exe	101
PID 2512 wrote to memory of 4668	2512	cmd.exe	101
PID 2512 wrote to memory of 4668	2512	cmd.exe	101
PID 2512 wrote to memory of 2956	2512	cmd.exe	102
PID 2512 wrote to memory of 2956	2512	cmd.exe	102
PID 2512 wrote to memory of 2956	2512	cmd.exe	102

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profile
    3⤵
    PID:3792
- - C:\Windows\SysWOW64\findstr.exe
    findstr All
    3⤵
    PID:2328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:4668
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    PID:2956

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\60411b70e5ccb0c2cbf035e52dc65224\Admin@MKDQUQPQ_en-US\Browsers\Firefox\Bookmarks.txt
Size 105B
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
MD5 SHA1 SHA512

Submit Download

OneDrive.txt

Path C:\Users\Admin\AppData\Local\60411b70e5ccb0c2cbf035e52dc65224\Admin@MKDQUQPQ_en-US\Directories\OneDrive.txt
Size 25B
SHA256 8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
MD5 966247eb3ee749e21597d73c4176bd52
SHA1 1e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA512 bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
MD5 SHA1 SHA512

Submit Download

Startup.txt

Path C:\Users\Admin\AppData\Local\60411b70e5ccb0c2cbf035e52dc65224\Admin@MKDQUQPQ_en-US\Directories\Startup.txt
Size 24B
SHA256 889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
MD5 68c93da4981d591704cea7b71cebfb97
SHA1 fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA512 63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
MD5 SHA1 SHA512

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\60411b70e5ccb0c2cbf035e52dc65224\Admin@MKDQUQPQ_en-US\Directories\Videos.txt
Size 23B
SHA256 a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
MD5 1fddbf1169b6c75898b86e7e24bc7c1f
SHA1 d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA512 20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
MD5 SHA1 SHA512

Submit Download

Apps.txt

Path C:\Users\Admin\AppData\Local\60411b70e5ccb0c2cbf035e52dc65224\Admin@MKDQUQPQ_en-US\System\Apps.txt
Size 3KB
SHA256 df1782121f5e75be65aa96941a609b71537993ca0a8af615783bac842f7b6d27
MD5 e6a54df1a8c6b513d092774be8afbc32
SHA1 cb223335e933f8e4445cd98a779f0c4d616c6c75
SHA512 e7b7e7d67091f8b50b33d70900f416cd808aade4c5e075136f4c7b4a234a7b6da1c5a3346f4b1c284ab27798462122db5d20c8d68bce07a6b17cdcd098732758
MD5 SHA1 SHA512

Submit Download

Apps.txt

Path C:\Users\Admin\AppData\Local\60411b70e5ccb0c2cbf035e52dc65224\Admin@MKDQUQPQ_en-US\System\Apps.txt
Size 5KB
SHA256 e03b93f7b9b62d76c8191637febd51323875bc01f4c91b223c4a4d1b8dfd35dc
MD5 d8ce2640026d6efcd23156bc77069f39
SHA1 d257298ac6878f4357e46c917e65eaf53ddd217a
SHA512 ad7cfffa873eab4e95077288c9dbd558505a6d873ba3a79701b16debe20d7f18dcbc721a3353c3608e74573563d8b751e9bf026dc9c116a58dd29214b04770b2
SSDEEP 96:Ofp0X3fp0XPfp0mFfmmQNpJfzQWEfRpKEfRDzfmtvufzbfF1SfF1aiRpqffQtrhL:wp0/p03p0imTzn2Rw2RXmyz7DsDkQLQE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\60411b70e5ccb0c2cbf035e52dc65224\Admin@MKDQUQPQ_en-US\System\Process.txt
Size 4KB
SHA256 9351c1f06ff757fc7ece1e677ea367f0f17fdade33154dab765c9450e6c479c1
MD5 dcce038a92d574e0e689a4b49fa8a6b2
SHA1 04eb6c9be0c07c501a93c55f6874093654005bb1
SHA512 4b80c4537df8ffb9b5bca15e988bbe2a336188d833f3f387b3f1a96b9b708c7095d8e7cc6d5181d51b76f0d6ba56764e432a14b7d1c911f0c2320d1483d1ae85
SSDEEP 48:1lNbw2hFMTnJjBtl4tCNb1uAVLtLl8i23Co2LQ2bWVqJ:1lN0SqTnTtNNBPLtLl8i23h2LBbWVqJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProductKey.txt

Path C:\Users\Admin\AppData\Local\60411b70e5ccb0c2cbf035e52dc65224\Admin@MKDQUQPQ_en-US\System\ProductKey.txt
Size 29B
SHA256 f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
MD5 71eb5479298c7afc6d126fa04d2a9bde
SHA1 a9b3d5505cf9f84bb6c2be2acece53cb40075113
SHA512 7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd
MD5 SHA1 SHA512

Submit Download

msgid.dat

Path C:\Users\Admin\AppData\Local\60411b70e5ccb0c2cbf035e52dc65224\msgid.dat
Size 19B
SHA256 ec3f505f231d431db83dee1102aff9f214f511d2ee7760fa14af80f867715d47
MD5 340fe8cb1cf65d1edfb02e6e1bfe528e
SHA1 040326a2547c88667604846458d552382796fa4c
SHA512 21dc7503df493020f4d804ddaa886ef666482ba1d89e72c89db4936541fcf1d1763b5cb6112af9feca9e2c24f761bdcd86013296e4e08620aec38dc521d2065b
MD5 SHA1 SHA512

Submit Download

memory/1556-200-0x0000000005650000-0x0000000005660000-memory.dmp

Download

memory/1556-7-0x0000000005ED0000-0x0000000005EF6000-memory.dmp

Download

memory/1556-68-0x0000000007AD0000-0x0000000007B62000-memory.dmp

Download

memory/1556-75-0x0000000008120000-0x00000000086C4000-memory.dmp

Download

memory/1556-10-0x0000000006E90000-0x0000000006E98000-memory.dmp

Download

memory/1556-9-0x0000000006E80000-0x0000000006E8A000-memory.dmp

Download

memory/1556-8-0x00000000056B0000-0x00000000056B8000-memory.dmp

Download

memory/1556-0-0x0000000000B90000-0x0000000000D22000-memory.dmp

Download

memory/1556-201-0x0000000007410000-0x000000000748A000-memory.dmp

Download

memory/1556-202-0x0000000005650000-0x0000000005660000-memory.dmp

Download

memory/1556-203-0x00000000744D0000-0x0000000074C80000-memory.dmp

Download

memory/1556-11-0x0000000006EB0000-0x0000000006ECE000-memory.dmp

Download

memory/1556-6-0x0000000005E40000-0x0000000005ED2000-memory.dmp

Download

memory/1556-3-0x0000000005650000-0x0000000005660000-memory.dmp

Download

memory/1556-2-0x00000000056D0000-0x0000000005736000-memory.dmp

Download

memory/1556-276-0x0000000007540000-0x00000000075F2000-memory.dmp

Download

memory/1556-278-0x0000000006FC0000-0x0000000006FE2000-memory.dmp

Download

memory/1556-279-0x0000000008AD0000-0x0000000008E24000-memory.dmp

Download

memory/1556-281-0x0000000005650000-0x0000000005660000-memory.dmp

Download

memory/1556-1-0x00000000744D0000-0x0000000074C80000-memory.dmp

Download

memory/1556-292-0x00000000079C0000-0x00000000079CA000-memory.dmp

Download

memory/1556-293-0x0000000005650000-0x0000000005660000-memory.dmp

Download

memory/1556-294-0x0000000005650000-0x0000000005660000-memory.dmp

Download