Resubmissions
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 22:24
Behavioral task
behavioral1
Sample
build.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
build.exe
Resource
win10v2004-20240508-en
General
-
Target
build.exe
-
Size
1.6MB
-
MD5
0f00ec8acd08f26ef6fcb2ff7792119c
-
SHA1
aca89906ae8ed315f7bb5ee5764860a431d04589
-
SHA256
0651c2d33fe45643e1e6c85297fd9a361dec41567daf035f00c8bfa81e12d122
-
SHA512
652db906239ada46dc959085a7c79598bcf8830e1aac8fc52f64ca4d1e5c094ae864ea078e4cac816fc1f4aa71004afdc41230574f1bec8b1d89c97d1983777f
-
SSDEEP
24576:3ei2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgLmG:3JTq24GjdGSiqkqXfd+/9AqYanieKd9
Malware Config
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 288 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2720 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
build.exepid process 1708 build.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
build.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1708 build.exe Token: SeDebugPrivilege 2720 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
build.execmd.exedescription pid process target process PID 1708 wrote to memory of 2552 1708 build.exe cmd.exe PID 1708 wrote to memory of 2552 1708 build.exe cmd.exe PID 1708 wrote to memory of 2552 1708 build.exe cmd.exe PID 1708 wrote to memory of 2552 1708 build.exe cmd.exe PID 2552 wrote to memory of 2992 2552 cmd.exe chcp.com PID 2552 wrote to memory of 2992 2552 cmd.exe chcp.com PID 2552 wrote to memory of 2992 2552 cmd.exe chcp.com PID 2552 wrote to memory of 2992 2552 cmd.exe chcp.com PID 2552 wrote to memory of 2720 2552 cmd.exe taskkill.exe PID 2552 wrote to memory of 2720 2552 cmd.exe taskkill.exe PID 2552 wrote to memory of 2720 2552 cmd.exe taskkill.exe PID 2552 wrote to memory of 2720 2552 cmd.exe taskkill.exe PID 2552 wrote to memory of 288 2552 cmd.exe timeout.exe PID 2552 wrote to memory of 288 2552 cmd.exe timeout.exe PID 2552 wrote to memory of 288 2552 cmd.exe timeout.exe PID 2552 wrote to memory of 288 2552 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp461D.tmp.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\taskkill.exeTaskKill /F /IM 17083⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exeTimeout /T 2 /Nobreak3⤵
- Delays execution with timeout.exe
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Cab44DF.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar44F1.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\tmp461D.tmp.batFilesize
57B
MD524fc638af1f00705ff6262fcf4240026
SHA1ea7b137ad8bf69f8f335b01a7f4723f6cf372921
SHA25662a0627067118669fa799408292326cf7e0e32ac686fa7c3208c7905bfb22616
SHA512d1a31af9d7ae3dcff9146eff58e688b1c784748d34ee5fdb9cd69825cac00f063bd79cda56a6c88db43d7769107acd24c3e454d42a2334fb20d4c085754fd394
-
memory/1708-0-0x000000007476E000-0x000000007476F000-memory.dmpFilesize
4KB
-
memory/1708-1-0x0000000000A90000-0x0000000000C22000-memory.dmpFilesize
1.6MB
-
memory/1708-2-0x0000000074760000-0x0000000074E4E000-memory.dmpFilesize
6.9MB
-
memory/1708-5-0x0000000005220000-0x00000000052B2000-memory.dmpFilesize
584KB
-
memory/1708-6-0x00000000004C0000-0x00000000004E6000-memory.dmpFilesize
152KB
-
memory/1708-7-0x0000000000500000-0x0000000000508000-memory.dmpFilesize
32KB
-
memory/1708-46-0x0000000074760000-0x0000000074E4E000-memory.dmpFilesize
6.9MB