stealerium | 71bf5d575aaba8c36b389685083fa8be7f1da640b90a295fa08ba3e1f614d2f9

Resubmissions

06/03/2024, 23:30

240306-3g8qmsbf62

06/03/2024, 23:27

240306-3fkmesce8y10

Analysis

max time kernel
7s
max time network
6s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build.exe
Size 1.6MB
Sample240306-3fkmesce8y
SHA256 71bf5d575aaba8c36b389685083fa8be7f1da640b90a295fa08ba3e1f614d2f9
MD5 b0a07f6e30e44b4deaabd473bb47279c
SHA1 1b23f54df9433867f891598b6d6c0c49ee9c60ae
SHA512 88c163371cd8aff7f1640cf0f9ea3d2794a5afa410407e74b66bcaf49ab2d53878fa58a3eccf6ee291ddac2bc790c481dedefc0b790989f016dfa986c63327c7
SSDEEP 49152:7kTq24GjdGSiqkqXfd+/9AqYanieKdsV:71EjdGSiqkqXf0FLYW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealerium stealer

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/746874720137510974/gFp2Kt67nYCbIxroRn1_VTAS1k-RlpmHIHGhPFuEtp4-B5VfIZyJ8ckhIQoyS2NaOJpO

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	build.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
38	discord.com
39	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1684	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3524	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4844	build.exe
4844	build.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	build.exe
Token: SeDebugPrivilege	3524	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 2760	4844	build.exe	99
PID 4844 wrote to memory of 2760	4844	build.exe	99
PID 4844 wrote to memory of 2760	4844	build.exe	99
PID 2760 wrote to memory of 4888	2760	cmd.exe	101
PID 2760 wrote to memory of 4888	2760	cmd.exe	101
PID 2760 wrote to memory of 4888	2760	cmd.exe	101
PID 2760 wrote to memory of 3524	2760	cmd.exe	102
PID 2760 wrote to memory of 3524	2760	cmd.exe	102
PID 2760 wrote to memory of 3524	2760	cmd.exe	102
PID 2760 wrote to memory of 1684	2760	cmd.exe	103
PID 2760 wrote to memory of 1684	2760	cmd.exe	103
PID 2760 wrote to memory of 1684	2760	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp545A.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\taskkill.exe
    TaskKill /F /IM 4844
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- - C:\Windows\SysWOW64\timeout.exe
    Timeout /T 2 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp545A.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp545A.tmp.bat
Size 57B
SHA256 246664b5c664bcd979453759d7b1b851bb4642068103270b6fd77556d98185e5
MD5 d4026de15a3c9f8991e4938ba44015a5
SHA1 c65e5c951848eff75075a76913922d4c8829afb2
SHA512 da45c410e5ced09f925d2bcdbb7561e7cb9fd980a7e2939bb9b95125da0861eaeb065ea2ea0e276f9928632a4f86d3c55c2a774219e6d231922338e54424d598
MD5 SHA1 SHA512

Submit Download

memory/4844-0-0x0000000000DB0000-0x0000000000F42000-memory.dmp

Download

memory/4844-1-0x0000000075280000-0x0000000075A30000-memory.dmp

Download

memory/4844-2-0x00000000058D0000-0x0000000005936000-memory.dmp

Download

memory/4844-3-0x0000000005950000-0x0000000005960000-memory.dmp

Download

memory/4844-6-0x0000000005E60000-0x0000000005EF2000-memory.dmp

Download

memory/4844-7-0x0000000005EF0000-0x0000000005F16000-memory.dmp

Download

memory/4844-8-0x0000000005F20000-0x0000000005F28000-memory.dmp

Download

memory/4844-13-0x0000000075280000-0x0000000075A30000-memory.dmp

Download