stealerium | ac82016516585cfb76c36a0808d84b263119b148f6a7aa7ab9d221d616954025

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fe0d791433b06792c910857a72fca50_NeikiAnalytics.exe
Size

1.6MB
MD5

5fe0d791433b06792c910857a72fca50
SHA1

0dedb715e809b5c5666bd8c9598f1ef2da405d1b
SHA256

ac82016516585cfb76c36a0808d84b263119b148f6a7aa7ab9d221d616954025
SHA512

9100856b77af8d1678adf33c4e0e7f643158a4be7937eb63ee05a5f06c6c5790a06cb4ad7660ac1bcd858160916d609d3c90f3690eb652481baa1280486bda9d
SSDEEP

49152:1kTq24GjdGSiqkqXfd+/9AqYanieKds6:11EjdGSiqkqXf0FLYW

Score

10^/10

stealerium stealer

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/1237701622168158289/yCA4XMxxNf2MMWFp1FwpefUD1pLGH0mhT_TQTwndsr1dAVvybWr3hp5JZAVJm0HcEBh8

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5fe0d791433b06792c910857a72fca50_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	5fe0d791433b06792c910857a72fca50_NeikiAnalytics.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

26 discord.com
27 discord.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

388 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3352 taskkill.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5fe0d791433b06792c910857a72fca50_NeikiAnalytics.exe

pid process

3032 5fe0d791433b06792c910857a72fca50_NeikiAnalytics.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5fe0d791433b06792c910857a72fca50_NeikiAnalytics.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 3032 5fe0d791433b06792c910857a72fca50_NeikiAnalytics.exe
Token: SeDebugPrivilege 3352 taskkill.exe

flow	ioc
26	discord.com
27	discord.com

pid	process
388	timeout.exe

pid	process
3352	taskkill.exe

pid	process
3032	5fe0d791433b06792c910857a72fca50_NeikiAnalytics.exe

description	pid	process
Token: SeDebugPrivilege	3032	5fe0d791433b06792c910857a72fca50_NeikiAnalytics.exe
Token: SeDebugPrivilege	3352	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5fe0d791433b06792c910857a72fca50_NeikiAnalytics.execmd.exe

description	pid	process	target process
PID 3032 wrote to memory of 3956	3032	5fe0d791433b06792c910857a72fca50_NeikiAnalytics.exe	cmd.exe
PID 3032 wrote to memory of 3956	3032	5fe0d791433b06792c910857a72fca50_NeikiAnalytics.exe	cmd.exe
PID 3032 wrote to memory of 3956	3032	5fe0d791433b06792c910857a72fca50_NeikiAnalytics.exe	cmd.exe
PID 3956 wrote to memory of 5064	3956	cmd.exe	chcp.com
PID 3956 wrote to memory of 5064	3956	cmd.exe	chcp.com
PID 3956 wrote to memory of 5064	3956	cmd.exe	chcp.com
PID 3956 wrote to memory of 3352	3956	cmd.exe	taskkill.exe
PID 3956 wrote to memory of 3352	3956	cmd.exe	taskkill.exe
PID 3956 wrote to memory of 3352	3956	cmd.exe	taskkill.exe
PID 3956 wrote to memory of 388	3956	cmd.exe	timeout.exe
PID 3956 wrote to memory of 388	3956	cmd.exe	timeout.exe
PID 3956 wrote to memory of 388	3956	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\5fe0d791433b06792c910857a72fca50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5fe0d791433b06792c910857a72fca50_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp75DC.tmp.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:3956

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:5064

C:\Windows\SysWOW64\taskkill.exe
TaskKill /F /IM 3032
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3352

C:\Windows\SysWOW64\timeout.exe
Timeout /T 2 /Nobreak
3⤵
- Delays execution with timeout.exe
PID:388

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp75DC.tmp.bat
Filesize
57B

MD5
9dab782a4cbec9d68f4e2e4bbff75b32

SHA1
0c4c19f17bcd21bb534ffd97ba392d2306c7d690

SHA256
fedc1a41154d4bf3bcea2b79e929ed445bd341d543796e9d4157748134a053dd

SHA512
1ebe2156c4e565c6deeb8a88644015b7d319f7178e353f2f8d67a1d43a16c50c45fcbb024f8bf4f444108cae33fa29349d1f0b30f782d92ffdf5be70f9f32068

Download Submit
memory/3032-0-0x000000007532E000-0x000000007532F000-memory.dmp

Filesize
4KB

Download
memory/3032-1-0x0000000000420000-0x00000000005B2000-memory.dmp

Filesize
1.6MB

Download
memory/3032-2-0x0000000004F10000-0x0000000004F76000-memory.dmp

Filesize
408KB

Download
memory/3032-3-0x0000000075320000-0x0000000075AD0000-memory.dmp

Filesize
7.7MB

Download
memory/3032-7-0x0000000005490000-0x0000000005522000-memory.dmp

Filesize
584KB

Download
memory/3032-8-0x0000000005520000-0x0000000005546000-memory.dmp

Filesize
152KB

Download
memory/3032-9-0x0000000005550000-0x0000000005558000-memory.dmp

Filesize
32KB

Download
memory/3032-14-0x0000000075320000-0x0000000075AD0000-memory.dmp

Filesize
7.7MB

Download