Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 03:02
Behavioral task
behavioral1
Sample
e09b3349afedd9bc6713f0640dac5a73.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e09b3349afedd9bc6713f0640dac5a73.exe
Resource
win10v2004-20240226-en
General
-
Target
e09b3349afedd9bc6713f0640dac5a73.exe
-
Size
3.7MB
-
MD5
e09b3349afedd9bc6713f0640dac5a73
-
SHA1
2bed69865fce75b42da5f53b02d74eaba01f7819
-
SHA256
f8cad8601b4d97cbe6befe13fce900eaa01063283a91ffae28038c9370f7b582
-
SHA512
48ed49531d29f503f1c8f25ab278de851560576aca96baa521b0c1b1b6b2887ba6c6d71cbed0049faaeb1c4c8b531b186f7eba5cd141ae1ececafc3aa280a213
-
SSDEEP
98304:VG0WE8JkdS9cHaXMsbNWhYq3bdckunUnU63:fvNIc6XyYq3bHtX
Malware Config
Signatures
-
Darkstealer
Darkstealer is a file grabber, data stealer, and RAT.
-
Detects Echelon Stealer payload 3 IoCs
resource yara_rule behavioral2/memory/3268-13-0x00000000000B0000-0x0000000000A4E000-memory.dmp family_echelon behavioral2/memory/3268-14-0x00000000000B0000-0x0000000000A4E000-memory.dmp family_echelon behavioral2/memory/3268-51-0x00000000000B0000-0x0000000000A4E000-memory.dmp family_echelon -
Echelon - DarkStealer Fork 3 IoCs
Payload resembles modified variant of Echelon Stealer called DarkStealer.
resource yara_rule behavioral2/memory/3268-13-0x00000000000B0000-0x0000000000A4E000-memory.dmp echelon_darkstealer behavioral2/memory/3268-14-0x00000000000B0000-0x0000000000A4E000-memory.dmp echelon_darkstealer behavioral2/memory/3268-51-0x00000000000B0000-0x0000000000A4E000-memory.dmp echelon_darkstealer -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e09b3349afedd9bc6713f0640dac5a73.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e09b3349afedd9bc6713f0640dac5a73.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e09b3349afedd9bc6713f0640dac5a73.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3268-13-0x00000000000B0000-0x0000000000A4E000-memory.dmp themida behavioral2/memory/3268-14-0x00000000000B0000-0x0000000000A4E000-memory.dmp themida behavioral2/memory/3268-51-0x00000000000B0000-0x0000000000A4E000-memory.dmp themida -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 e09b3349afedd9bc6713f0640dac5a73.exe Key opened \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 e09b3349afedd9bc6713f0640dac5a73.exe Key opened \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 e09b3349afedd9bc6713f0640dac5a73.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e09b3349afedd9bc6713f0640dac5a73.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3268 e09b3349afedd9bc6713f0640dac5a73.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2812 3268 WerFault.exe 90 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3268 e09b3349afedd9bc6713f0640dac5a73.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3268 e09b3349afedd9bc6713f0640dac5a73.exe -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 e09b3349afedd9bc6713f0640dac5a73.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 e09b3349afedd9bc6713f0640dac5a73.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e09b3349afedd9bc6713f0640dac5a73.exe"C:\Users\Admin\AppData\Local\Temp\e09b3349afedd9bc6713f0640dac5a73.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Accesses Microsoft Outlook profiles
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3268 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 18922⤵
- Program crash
PID:2812
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3268 -ip 32681⤵PID:2628