stealerium | 0651c2d33fe45643e1e6c85297fd9a361dec41567daf035f00c8bfa81e12d122

Analysis

max time kernel
129s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build.exe
Size 1.6MB
Sample240524-2bpvxadb9w
SHA256 0651c2d33fe45643e1e6c85297fd9a361dec41567daf035f00c8bfa81e12d122
MD5 0f00ec8acd08f26ef6fcb2ff7792119c
SHA1 aca89906ae8ed315f7bb5ee5764860a431d04589
SHA512 652db906239ada46dc959085a7c79598bcf8830e1aac8fc52f64ca4d1e5c094ae864ea078e4cac816fc1f4aa71004afdc41230574f1bec8b1d89c97d1983777f
SSDEEP 24576:3ei2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgLmG:3JTq24GjdGSiqkqXfd+/9AqYanieKd9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealerium stealer

Malware Config

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	build.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
13	discord.com
14	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3008	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
400	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4536	build.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	build.exe
Token: SeDebugPrivilege	400	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 2928	4536	build.exe	92
PID 4536 wrote to memory of 2928	4536	build.exe	92
PID 4536 wrote to memory of 2928	4536	build.exe	92
PID 2928 wrote to memory of 4968	2928	cmd.exe	94
PID 2928 wrote to memory of 4968	2928	cmd.exe	94
PID 2928 wrote to memory of 4968	2928	cmd.exe	94
PID 2928 wrote to memory of 400	2928	cmd.exe	95
PID 2928 wrote to memory of 400	2928	cmd.exe	95
PID 2928 wrote to memory of 400	2928	cmd.exe	95
PID 2928 wrote to memory of 3008	2928	cmd.exe	96
PID 2928 wrote to memory of 3008	2928	cmd.exe	96
PID 2928 wrote to memory of 3008	2928	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5A16.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\taskkill.exe
    TaskKill /F /IM 4536
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:400
- - C:\Windows\SysWOW64\timeout.exe
    Timeout /T 2 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp5A16.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp5A16.tmp.bat
Size 57B
SHA256 f04af442e8ed29a7ea8233eba5483af5adbaf9b20dcf7e1bf28d40ebb3441633
MD5 27a6f6845dd6f2b029eb939eefa0e878
SHA1 7ae2be02a80d6ab63b28b0a0791283748745f437
SHA512 cd9ba16485152173006c619b687a8621e2422427c5412c613f92474079499f2bc71e08cb6658e55e32156a202b0bb45ee30b265a7bd192fb6443dc8a953c8919
MD5 SHA1 SHA512

Submit Download

memory/4536-0-0x00000000749DE000-0x00000000749DF000-memory.dmp

Download

memory/4536-1-0x00000000000A0000-0x0000000000232000-memory.dmp

Download

memory/4536-2-0x0000000004BC0000-0x0000000004C26000-memory.dmp

Download

memory/4536-3-0x00000000749D0000-0x0000000075180000-memory.dmp

Download

memory/4536-6-0x0000000005160000-0x00000000051F2000-memory.dmp

Download

memory/4536-7-0x00000000051F0000-0x0000000005216000-memory.dmp

Download

memory/4536-8-0x0000000004FD0000-0x0000000004FD8000-memory.dmp

Download

memory/4536-13-0x00000000749D0000-0x0000000075180000-memory.dmp

Download