stealerium | f4deeaeaf6a4173c46ef5df50139cd54d144dc0cc0d685b2717c1590cc8b1b1b

General

Target

file.exe
Size

57KB
MD5

8017a1bc98f4fdb536bef45a99951805
SHA1

d0896c713baa2873bda66c77469763c95dad7248
SHA256

f4deeaeaf6a4173c46ef5df50139cd54d144dc0cc0d685b2717c1590cc8b1b1b
SHA512

4a931e8ed6a3d5e547c4925b026d46be660f33b5c427721032df2ca5ad380b3e1abf215355fef911bc148784d4acf71c2e8ac4b729e6c4700cf8a2325a3b2152
SSDEEP

1536:mMA5VMU4wbWW8C5BkbvGoB264yLV6gQOXQz:mMA5VCwbWHkBkbv9gA0gQOXK

Score

10^/10

stealerium xworm execution rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

C2

publisher-misc.gl.at.ply.gg:58207:58207

publisher-misc.gl.at.ply.gg:58207

Attributes

Install_directory
%Temp%
install_file
RuntimeBroker.exe

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2256-1-0x0000000000810000-0x0000000000824000-memory.dmp	family_xworm

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1300 powershell.exe
4520 powershell.exe
3624 powershell.exe
2660 powershell.exe

pid	process
1300	powershell.exe
4520	powershell.exe
3624	powershell.exe
2660	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

file.exevjbdyr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	vjbdyr.exe

Drops startup file 2 IoCs

Processes:

file.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk	file.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk	file.exe

Executes dropped EXE 1 IoCs

Processes:

vjbdyr.exe

pid process

320 vjbdyr.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1068 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2328 taskkill.exe

pid	process
320	vjbdyr.exe

pid	process
1068	timeout.exe

pid	process
2328	taskkill.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	process
3624	powershell.exe
3624	powershell.exe
2660	powershell.exe
2660	powershell.exe
1300	powershell.exe
1300	powershell.exe
4520	powershell.exe
4520	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

file.exepowershell.exepowershell.exepowershell.exepowershell.exevjbdyr.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2256	file.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	320	vjbdyr.exe
Token: SeDebugPrivilege	2328	taskkill.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

file.exevjbdyr.execmd.exe

description	pid	process	target process
PID 2256 wrote to memory of 3624	2256	file.exe	powershell.exe
PID 2256 wrote to memory of 3624	2256	file.exe	powershell.exe
PID 2256 wrote to memory of 2660	2256	file.exe	powershell.exe
PID 2256 wrote to memory of 2660	2256	file.exe	powershell.exe
PID 2256 wrote to memory of 1300	2256	file.exe	powershell.exe
PID 2256 wrote to memory of 1300	2256	file.exe	powershell.exe
PID 2256 wrote to memory of 4520	2256	file.exe	powershell.exe
PID 2256 wrote to memory of 4520	2256	file.exe	powershell.exe
PID 2256 wrote to memory of 320	2256	file.exe	vjbdyr.exe
PID 2256 wrote to memory of 320	2256	file.exe	vjbdyr.exe
PID 2256 wrote to memory of 320	2256	file.exe	vjbdyr.exe
PID 320 wrote to memory of 4380	320	vjbdyr.exe	cmd.exe
PID 320 wrote to memory of 4380	320	vjbdyr.exe	cmd.exe
PID 320 wrote to memory of 4380	320	vjbdyr.exe	cmd.exe
PID 4380 wrote to memory of 2028	4380	cmd.exe	chcp.com
PID 4380 wrote to memory of 2028	4380	cmd.exe	chcp.com
PID 4380 wrote to memory of 2028	4380	cmd.exe	chcp.com
PID 4380 wrote to memory of 2328	4380	cmd.exe	taskkill.exe
PID 4380 wrote to memory of 2328	4380	cmd.exe	taskkill.exe
PID 4380 wrote to memory of 2328	4380	cmd.exe	taskkill.exe
PID 4380 wrote to memory of 1068	4380	cmd.exe	timeout.exe
PID 4380 wrote to memory of 1068	4380	cmd.exe	timeout.exe
PID 4380 wrote to memory of 1068	4380	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\file.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'file.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Users\Admin\AppData\Local\Temp\vjbdyr.exe
"C:\Users\Admin\AppData\Local\Temp\vjbdyr.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpB45C.tmp.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:4380

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:2028

C:\Windows\SysWOW64\taskkill.exe
TaskKill /F /IM 320
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2328

C:\Windows\SysWOW64\timeout.exe
Timeout /T 2 /Nobreak
4⤵
- Delays execution with timeout.exe
PID:1068

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
67c47240cc90de5d56338fdedb9ce2a2

SHA1
f56c843e20711a744638ec85842a82f437cfde68

SHA256
8e7dd332a5db18a40196355226f95137965757cfc87d25d133557e5e097cab3d

SHA512
ac74960d342e1885a5522a4e1422c43cb4c3056c0d5dacad438c345efdfe26bd9d015a1ef4bd24c90c6db4f7d6687a992c834f638b045a7b2500404e242f855a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d8cb3e9459807e35f02130fad3f9860d

SHA1
5af7f32cb8a30e850892b15e9164030a041f4bd6

SHA256
2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68

SHA512
045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z45ou3qe.wr2.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB45C.tmp.bat
Filesize
56B

MD5
737cdc95481994264c5bacb4d5906571

SHA1
5f76b6fe71aaba062508906943ae593c6c29f54d

SHA256
4f444d5dab15f576834e85e963bb59f88a55cc72f852c96d2ae4be7406a13402

SHA512
2c7eee63284df46deb63b751f668f44083449d9d7a3db04f3998a6f3ad2e76aa496b172ebeffb5587834346237ee492379632e55fb6f444645e6c715b42b2080

Download Submit
C:\Users\Admin\AppData\Local\Temp\vjbdyr.exe
Filesize
1.6MB

MD5
6627adf7167ee571e8fd6c8b1a0e8ae3

SHA1
03b9112660ee73c59d84e219f15bf24ae9df48db

SHA256
6c5935bcddaa1d4f809487f66db758e892cc0a7fd7704d138904bc879644ea1f

SHA512
e05896a6e0d09d4dafeb2467395ca06ae1e728a4aa079041dea82940caeb71646984604fdeea482748423b10257b8462db4f573682f9f719939143fdb5691c60

Download Submit
memory/320-69-0x00000000005C0000-0x0000000000752000-memory.dmp

Filesize
1.6MB

Download
memory/320-70-0x0000000004FA0000-0x0000000005006000-memory.dmp

Filesize
408KB

Download
memory/2256-56-0x00007FFC198A0000-0x00007FFC1A361000-memory.dmp

Filesize
10.8MB

Download
memory/2256-57-0x000000001BEF0000-0x000000001BEFE000-memory.dmp

Filesize
56KB

Download
memory/2256-0-0x00007FFC198A3000-0x00007FFC198A5000-memory.dmp

Filesize
8KB

Download
memory/2256-71-0x000000001DAD0000-0x000000001DE20000-memory.dmp

Filesize
3.3MB

Download
memory/2256-1-0x0000000000810000-0x0000000000824000-memory.dmp

Filesize
80KB

Download
memory/2256-74-0x00007FFC198A0000-0x00007FFC1A361000-memory.dmp

Filesize
10.8MB

Download
memory/3624-17-0x00007FFC198A0000-0x00007FFC1A361000-memory.dmp

Filesize
10.8MB

Download
memory/3624-14-0x00007FFC198A0000-0x00007FFC1A361000-memory.dmp

Filesize
10.8MB

Download
memory/3624-13-0x00007FFC198A0000-0x00007FFC1A361000-memory.dmp

Filesize
10.8MB

Download
memory/3624-12-0x00007FFC198A0000-0x00007FFC1A361000-memory.dmp

Filesize
10.8MB

Download
memory/3624-2-0x000001BEAFFB0000-0x000001BEAFFD2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads