Resubmissions
Analysis
-
max time kernel
129s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 22:24
Behavioral task
behavioral1
Sample
build.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
build.exe
Resource
win10v2004-20240508-en
General
-
Target
build.exe
-
Size
1.6MB
-
MD5
0f00ec8acd08f26ef6fcb2ff7792119c
-
SHA1
aca89906ae8ed315f7bb5ee5764860a431d04589
-
SHA256
0651c2d33fe45643e1e6c85297fd9a361dec41567daf035f00c8bfa81e12d122
-
SHA512
652db906239ada46dc959085a7c79598bcf8830e1aac8fc52f64ca4d1e5c094ae864ea078e4cac816fc1f4aa71004afdc41230574f1bec8b1d89c97d1983777f
-
SSDEEP
24576:3ei2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgLmG:3JTq24GjdGSiqkqXfd+/9AqYanieKd9
Malware Config
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
build.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation build.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3008 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 400 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
build.exepid process 4536 build.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
build.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4536 build.exe Token: SeDebugPrivilege 400 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
build.execmd.exedescription pid process target process PID 4536 wrote to memory of 2928 4536 build.exe cmd.exe PID 4536 wrote to memory of 2928 4536 build.exe cmd.exe PID 4536 wrote to memory of 2928 4536 build.exe cmd.exe PID 2928 wrote to memory of 4968 2928 cmd.exe chcp.com PID 2928 wrote to memory of 4968 2928 cmd.exe chcp.com PID 2928 wrote to memory of 4968 2928 cmd.exe chcp.com PID 2928 wrote to memory of 400 2928 cmd.exe taskkill.exe PID 2928 wrote to memory of 400 2928 cmd.exe taskkill.exe PID 2928 wrote to memory of 400 2928 cmd.exe taskkill.exe PID 2928 wrote to memory of 3008 2928 cmd.exe timeout.exe PID 2928 wrote to memory of 3008 2928 cmd.exe timeout.exe PID 2928 wrote to memory of 3008 2928 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5A16.tmp.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\taskkill.exeTaskKill /F /IM 45363⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exeTimeout /T 2 /Nobreak3⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5A16.tmp.batFilesize
57B
MD527a6f6845dd6f2b029eb939eefa0e878
SHA17ae2be02a80d6ab63b28b0a0791283748745f437
SHA256f04af442e8ed29a7ea8233eba5483af5adbaf9b20dcf7e1bf28d40ebb3441633
SHA512cd9ba16485152173006c619b687a8621e2422427c5412c613f92474079499f2bc71e08cb6658e55e32156a202b0bb45ee30b265a7bd192fb6443dc8a953c8919
-
memory/4536-0-0x00000000749DE000-0x00000000749DF000-memory.dmpFilesize
4KB
-
memory/4536-1-0x00000000000A0000-0x0000000000232000-memory.dmpFilesize
1.6MB
-
memory/4536-2-0x0000000004BC0000-0x0000000004C26000-memory.dmpFilesize
408KB
-
memory/4536-3-0x00000000749D0000-0x0000000075180000-memory.dmpFilesize
7.7MB
-
memory/4536-6-0x0000000005160000-0x00000000051F2000-memory.dmpFilesize
584KB
-
memory/4536-7-0x00000000051F0000-0x0000000005216000-memory.dmpFilesize
152KB
-
memory/4536-8-0x0000000004FD0000-0x0000000004FD8000-memory.dmpFilesize
32KB
-
memory/4536-13-0x00000000749D0000-0x0000000075180000-memory.dmpFilesize
7.7MB