stealerium | 0651c2d33fe45643e1e6c85297fd9a361dec41567daf035f00c8bfa81e12d122

Resubmissions

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

build.exe
Size

1.6MB
MD5

0f00ec8acd08f26ef6fcb2ff7792119c
SHA1

aca89906ae8ed315f7bb5ee5764860a431d04589
SHA256

0651c2d33fe45643e1e6c85297fd9a361dec41567daf035f00c8bfa81e12d122
SHA512

652db906239ada46dc959085a7c79598bcf8830e1aac8fc52f64ca4d1e5c094ae864ea078e4cac816fc1f4aa71004afdc41230574f1bec8b1d89c97d1983777f
SSDEEP

24576:3ei2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgLmG:3JTq24GjdGSiqkqXfd+/9AqYanieKd9

Score

10^/10

stealerium stealer

Malware Config

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

2 discord.com
3 discord.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

288 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2720 taskkill.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

build.exe

pid process

1708 build.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

build.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 1708 build.exe
Token: SeDebugPrivilege 2720 taskkill.exe

flow	ioc
2	discord.com
3	discord.com

pid	process
288	timeout.exe

pid	process
2720	taskkill.exe

pid	process
1708	build.exe

description	pid	process
Token: SeDebugPrivilege	1708	build.exe
Token: SeDebugPrivilege	2720	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

build.execmd.exe

description	pid	process	target process
PID 1708 wrote to memory of 2552	1708	build.exe	cmd.exe
PID 1708 wrote to memory of 2552	1708	build.exe	cmd.exe
PID 1708 wrote to memory of 2552	1708	build.exe	cmd.exe
PID 1708 wrote to memory of 2552	1708	build.exe	cmd.exe
PID 2552 wrote to memory of 2992	2552	cmd.exe	chcp.com
PID 2552 wrote to memory of 2992	2552	cmd.exe	chcp.com
PID 2552 wrote to memory of 2992	2552	cmd.exe	chcp.com
PID 2552 wrote to memory of 2992	2552	cmd.exe	chcp.com
PID 2552 wrote to memory of 2720	2552	cmd.exe	taskkill.exe
PID 2552 wrote to memory of 2720	2552	cmd.exe	taskkill.exe
PID 2552 wrote to memory of 2720	2552	cmd.exe	taskkill.exe
PID 2552 wrote to memory of 2720	2552	cmd.exe	taskkill.exe
PID 2552 wrote to memory of 288	2552	cmd.exe	timeout.exe
PID 2552 wrote to memory of 288	2552	cmd.exe	timeout.exe
PID 2552 wrote to memory of 288	2552	cmd.exe	timeout.exe
PID 2552 wrote to memory of 288	2552	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp461D.tmp.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:2992

C:\Windows\SysWOW64\taskkill.exe
TaskKill /F /IM 1708
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\SysWOW64\timeout.exe
Timeout /T 2 /Nobreak
3⤵
- Delays execution with timeout.exe
PID:288

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1612

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab44DF.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar44F1.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp461D.tmp.bat
Filesize
57B

MD5
24fc638af1f00705ff6262fcf4240026

SHA1
ea7b137ad8bf69f8f335b01a7f4723f6cf372921

SHA256
62a0627067118669fa799408292326cf7e0e32ac686fa7c3208c7905bfb22616

SHA512
d1a31af9d7ae3dcff9146eff58e688b1c784748d34ee5fdb9cd69825cac00f063bd79cda56a6c88db43d7769107acd24c3e454d42a2334fb20d4c085754fd394

Download Submit
memory/1708-0-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/1708-1-0x0000000000A90000-0x0000000000C22000-memory.dmp

Filesize
1.6MB

Download
memory/1708-2-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/1708-5-0x0000000005220000-0x00000000052B2000-memory.dmp

Filesize
584KB

Download
memory/1708-6-0x00000000004C0000-0x00000000004E6000-memory.dmp

Filesize
152KB

Download
memory/1708-7-0x0000000000500000-0x0000000000508000-memory.dmp

Filesize
32KB

Download
memory/1708-46-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download