stealerium | cac65612657f8286cbc762e58b140881b133b06bdfecf70970dd1b4ebca05200

Analysis

max time kernel
36s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

build.exe
Size

1.6MB
MD5

63acc4e186a38ca51588c82988f245ce
SHA1

a5a1279bb1b13aae2f9fcf762b85b12edaebaaab
SHA256

cac65612657f8286cbc762e58b140881b133b06bdfecf70970dd1b4ebca05200
SHA512

633526dd11c8c22ddaa33fd19cb1fb06d9bcf30f8a4d1e0ef914ac2af1800a24f844f88614725247720251b41519653ebf234e05110f0a37d737a281b1de674a
SSDEEP

24576:li2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgL4B:MTq24GjdGSiqkqXfd+/9AqYanieKd

Score

10^/10

stealerium stealer

Malware Config

Extracted

Family

stealerium

bc1qea9m68q0zex4gpp8wgpaswg6hd03skjlap4j74

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

build.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation build.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

23 discord.com
24 discord.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4616 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

972 taskkill.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

build.exe

pid process

3508 build.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

build.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 3508 build.exe
Token: SeDebugPrivilege 972 taskkill.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	build.exe

flow	ioc
23	discord.com
24	discord.com

pid	process
4616	timeout.exe

pid	process
972	taskkill.exe

pid	process
3508	build.exe

description	pid	process
Token: SeDebugPrivilege	3508	build.exe
Token: SeDebugPrivilege	972	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

build.execmd.exe

description	pid	process	target process
PID 3508 wrote to memory of 4172	3508	build.exe	cmd.exe
PID 3508 wrote to memory of 4172	3508	build.exe	cmd.exe
PID 3508 wrote to memory of 4172	3508	build.exe	cmd.exe
PID 4172 wrote to memory of 2532	4172	cmd.exe	chcp.com
PID 4172 wrote to memory of 2532	4172	cmd.exe	chcp.com
PID 4172 wrote to memory of 2532	4172	cmd.exe	chcp.com
PID 4172 wrote to memory of 972	4172	cmd.exe	taskkill.exe
PID 4172 wrote to memory of 972	4172	cmd.exe	taskkill.exe
PID 4172 wrote to memory of 972	4172	cmd.exe	taskkill.exe
PID 4172 wrote to memory of 4616	4172	cmd.exe	timeout.exe
PID 4172 wrote to memory of 4616	4172	cmd.exe	timeout.exe
PID 4172 wrote to memory of 4616	4172	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp607A.tmp.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:4172

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:2532

C:\Windows\SysWOW64\taskkill.exe
TaskKill /F /IM 3508
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:972

C:\Windows\SysWOW64\timeout.exe
Timeout /T 2 /Nobreak
3⤵
- Delays execution with timeout.exe
PID:4616

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp607A.tmp.bat
Filesize
57B

MD5
5f86451f14ef787786e584ddc5a81796

SHA1
a83e7ab6b61fef15dbd9568b585fb7e2d41d290a

SHA256
0e4cd0fc5d568af535b3996efc94e46f8b5c8a95329e413715447da47fb35534

SHA512
7c7153cdf35b0e5fe86d3cdb7eed32c56e12e566e0a686374e6b8644460db1c43058e288daa1030d1d5b7fca57296905790bf10ac16e4d41b4002956af6a9ecc

Download Submit
memory/3508-0-0x00000000747CE000-0x00000000747CF000-memory.dmp

Filesize
4KB

Download
memory/3508-1-0x0000000000AC0000-0x0000000000C56000-memory.dmp

Filesize
1.6MB

Download
memory/3508-2-0x00000000055E0000-0x0000000005646000-memory.dmp

Filesize
408KB

Download
memory/3508-3-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/3508-6-0x00000000747CE000-0x00000000747CF000-memory.dmp

Filesize
4KB

Download
memory/3508-7-0x0000000005E90000-0x0000000005F22000-memory.dmp

Filesize
584KB

Download
memory/3508-8-0x00000000056D0000-0x00000000056F6000-memory.dmp

Filesize
152KB

Download
memory/3508-9-0x0000000005F30000-0x0000000005F38000-memory.dmp

Filesize
32KB

Download
memory/3508-14-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download