stealerium | 71bf5d575aaba8c36b389685083fa8be7f1da640b90a295fa08ba3e1f614d2f9

Resubmissions

06/03/2024, 23:30

240306-3g8qmsbf62

06/03/2024, 23:27

240306-3fkmesce8y10

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build.exe
Size 1.6MB
Sample240306-3fkmesce8y
SHA256 71bf5d575aaba8c36b389685083fa8be7f1da640b90a295fa08ba3e1f614d2f9
MD5 b0a07f6e30e44b4deaabd473bb47279c
SHA1 1b23f54df9433867f891598b6d6c0c49ee9c60ae
SHA512 88c163371cd8aff7f1640cf0f9ea3d2794a5afa410407e74b66bcaf49ab2d53878fa58a3eccf6ee291ddac2bc790c481dedefc0b790989f016dfa986c63327c7
SSDEEP 49152:7kTq24GjdGSiqkqXfd+/9AqYanieKdsV:71EjdGSiqkqXf0FLYW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealerium stealer

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/746874720137510974/gFp2Kt67nYCbIxroRn1_VTAS1k-RlpmHIHGhPFuEtp4-B5VfIZyJ8ckhIQoyS2NaOJpO

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	discord.com
3	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1528	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2640	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1680	build.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	build.exe
Token: SeDebugPrivilege	2640	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1564	1680	build.exe	29
PID 1680 wrote to memory of 1564	1680	build.exe	29
PID 1680 wrote to memory of 1564	1680	build.exe	29
PID 1680 wrote to memory of 1564	1680	build.exe	29
PID 1564 wrote to memory of 1364	1564	cmd.exe	31
PID 1564 wrote to memory of 1364	1564	cmd.exe	31
PID 1564 wrote to memory of 1364	1564	cmd.exe	31
PID 1564 wrote to memory of 1364	1564	cmd.exe	31
PID 1564 wrote to memory of 2640	1564	cmd.exe	32
PID 1564 wrote to memory of 2640	1564	cmd.exe	32
PID 1564 wrote to memory of 2640	1564	cmd.exe	32
PID 1564 wrote to memory of 2640	1564	cmd.exe	32
PID 1564 wrote to memory of 1528	1564	cmd.exe	33
PID 1564 wrote to memory of 1528	1564	cmd.exe	33
PID 1564 wrote to memory of 1528	1564	cmd.exe	33
PID 1564 wrote to memory of 1528	1564	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp1138.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:1364
- - C:\Windows\SysWOW64\taskkill.exe
    TaskKill /F /IM 1680
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2640
- - C:\Windows\SysWOW64\timeout.exe
    Timeout /T 2 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 67KB
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
SSDEEP 1536:4vHkVfDISE//aDY0WAXTF+0daIpyFQaqPZkatNjgkFOE4/JZZWnEn6:4vHKfMSeKFXdBcmnXkksE40E6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar10CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar10CA.tmp
Size 175KB
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
SSDEEP 1536:DAuJ+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mr:D9J+qTR0XCy/dmASru2Aijbd0
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1138.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp1138.tmp.bat
Size 57B
SHA256 9dc0cfe276bb1c63ec4a3edbf2973589ba5ba2895d4f392b2aaf9e64bbc78370
MD5 722732b88e066a8ff552976fcb30d9b7
SHA1 7b0fc7bf2d585a78648e135a66537a169fa87611
SHA512 28d64723c1ef0334f9086e40ad6d808de3dd39c526fa84b656ea46a153fe9a01f48ae376268a42648d02ba6a854c1f674100ab58dab422ea2163de18dde7356e
MD5 SHA1 SHA512

Submit Download

memory/1680-0-0x0000000000E90000-0x0000000001022000-memory.dmp

Download

memory/1680-1-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Download

memory/1680-2-0x00000000006C0000-0x0000000000700000-memory.dmp

Download

memory/1680-5-0x0000000005020000-0x00000000050B2000-memory.dmp

Download

memory/1680-6-0x0000000000700000-0x0000000000726000-memory.dmp

Download

memory/1680-7-0x0000000000770000-0x0000000000778000-memory.dmp

Download

memory/1680-49-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Download