stealerium | 9a6b55d533c291f4b8706630f55663db1a11b2a1af3bf536b4a2abfa9761633e

Analysis

max time kernel
67s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

build.exe
Size

1.6MB
MD5

03c0235c09b30b61f40fbb65d5bee883
SHA1

31d971d0fc6293ad67a0c84ea88d0e7e15c4ce29
SHA256

9a6b55d533c291f4b8706630f55663db1a11b2a1af3bf536b4a2abfa9761633e
SHA512

454288409757bc72c4b66ab66de02cb3d8559c1fdabac032885752819560f2d4c968674aca85ffa6430addd5a9fbfa12cb80cf9f131dcefb09c343eddafff540
SSDEEP

49152:DcTq24GjdGSiqkqXfd+/9AqYanieKdYX:D9EjdGSiqkqXf0FLYW

Score

10^/10

stealerium stealer

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/1234145797856038953/Qx5Y46YXxYE_v9-5-5iTyAlkR-pe2Cn2DAdNinRgP7FgwC51wV8RMBhojwvQHc9imqqi

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

build.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation build.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

3 discord.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3824 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4616 taskkill.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

build.exe

pid process

3400 build.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

build.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 3400 build.exe
Token: SeDebugPrivilege 4616 taskkill.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	build.exe

flow	ioc
3	discord.com

pid	process
3824	timeout.exe

pid	process
4616	taskkill.exe

pid	process
3400	build.exe

description	pid	process
Token: SeDebugPrivilege	3400	build.exe
Token: SeDebugPrivilege	4616	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

build.execmd.exe

description	pid	process	target process
PID 3400 wrote to memory of 2932	3400	build.exe	cmd.exe
PID 3400 wrote to memory of 2932	3400	build.exe	cmd.exe
PID 3400 wrote to memory of 2932	3400	build.exe	cmd.exe
PID 2932 wrote to memory of 2180	2932	cmd.exe	chcp.com
PID 2932 wrote to memory of 2180	2932	cmd.exe	chcp.com
PID 2932 wrote to memory of 2180	2932	cmd.exe	chcp.com
PID 2932 wrote to memory of 4616	2932	cmd.exe	taskkill.exe
PID 2932 wrote to memory of 4616	2932	cmd.exe	taskkill.exe
PID 2932 wrote to memory of 4616	2932	cmd.exe	taskkill.exe
PID 2932 wrote to memory of 3824	2932	cmd.exe	timeout.exe
PID 2932 wrote to memory of 3824	2932	cmd.exe	timeout.exe
PID 2932 wrote to memory of 3824	2932	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp74D2.tmp.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:2180

C:\Windows\SysWOW64\taskkill.exe
TaskKill /F /IM 3400
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\SysWOW64\timeout.exe
Timeout /T 2 /Nobreak
3⤵
- Delays execution with timeout.exe
PID:3824

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp74D2.tmp.bat
Filesize
57B

MD5
a906b711838dbeb94b564e15e7321638

SHA1
25761313e1c959df80f239631355af7821a2f9a5

SHA256
108b2b0d66f5ba121854c935dde842ee0d225decf9270692872c348060454e2c

SHA512
1956a15e60bd2368628951e00a31e1c8446cfa23bdc55965d24b475365b06eeb8e86bf2987c3623d2fa84a427d882098fea7d1e2d99e4d33f21072daea26175b

Download Submit
memory/3400-0-0x0000000000550000-0x00000000006E4000-memory.dmp

Filesize
1.6MB

Download
memory/3400-1-0x0000000075200000-0x00000000759B0000-memory.dmp

Filesize
7.7MB

Download
memory/3400-2-0x0000000005070000-0x00000000050D6000-memory.dmp

Filesize
408KB

Download
memory/3400-3-0x0000000005200000-0x0000000005210000-memory.dmp

Filesize
64KB

Download
memory/3400-6-0x0000000005600000-0x0000000005692000-memory.dmp

Filesize
584KB

Download
memory/3400-7-0x0000000005690000-0x00000000056B6000-memory.dmp

Filesize
152KB

Download
memory/3400-8-0x00000000056C0000-0x00000000056C8000-memory.dmp

Filesize
32KB

Download
memory/3400-13-0x0000000075200000-0x00000000759B0000-memory.dmp

Filesize
7.7MB

Download