stealerium | 49d8c623abc37dff7af7d7ea15fa66b27504f166b5bf7a2d486c41ce7923a722

Resubmissions

28-05-2024 15:28

240528-swf9tsbd55 10

28-05-2024 15:26

240528-svjnkabd22 10

Analysis

max time kernel
90s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
28-05-2024 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stub/stub.exe
Size

1.6MB
MD5

6627adf7167ee571e8fd6c8b1a0e8ae3
SHA1

03b9112660ee73c59d84e219f15bf24ae9df48db
SHA256

6c5935bcddaa1d4f809487f66db758e892cc0a7fd7704d138904bc879644ea1f
SHA512

e05896a6e0d09d4dafeb2467395ca06ae1e728a4aa079041dea82940caeb71646984604fdeea482748423b10257b8462db4f573682f9f719939143fdb5691c60
SSDEEP

49152:19Tq24GjdGSiqkqXfd+/9AqYanieKd0U:1YEjdGSiqkqXf0FLYW

Score

10^/10

stealerium stealer

Malware Config

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3092 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2036 taskkill.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

stub.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 4616 stub.exe
Token: SeDebugPrivilege 2036 taskkill.exe

pid	process
3092	timeout.exe

pid	process
2036	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	4616	stub.exe
Token: SeDebugPrivilege	2036	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

stub.execmd.exe

description	pid	process	target process
PID 4616 wrote to memory of 4104	4616	stub.exe	cmd.exe
PID 4616 wrote to memory of 4104	4616	stub.exe	cmd.exe
PID 4616 wrote to memory of 4104	4616	stub.exe	cmd.exe
PID 4104 wrote to memory of 4564	4104	cmd.exe	chcp.com
PID 4104 wrote to memory of 4564	4104	cmd.exe	chcp.com
PID 4104 wrote to memory of 4564	4104	cmd.exe	chcp.com
PID 4104 wrote to memory of 2036	4104	cmd.exe	taskkill.exe
PID 4104 wrote to memory of 2036	4104	cmd.exe	taskkill.exe
PID 4104 wrote to memory of 2036	4104	cmd.exe	taskkill.exe
PID 4104 wrote to memory of 3092	4104	cmd.exe	timeout.exe
PID 4104 wrote to memory of 3092	4104	cmd.exe	timeout.exe
PID 4104 wrote to memory of 3092	4104	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\Stub\stub.exe
"C:\Users\Admin\AppData\Local\Temp\Stub\stub.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5A93.tmp.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:4104

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:4564

C:\Windows\SysWOW64\taskkill.exe
TaskKill /F /IM 4616
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\SysWOW64\timeout.exe
Timeout /T 2 /Nobreak
3⤵
- Delays execution with timeout.exe
PID:3092

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5A93.tmp.bat
Filesize
57B

MD5
75b1e9263fc7b98d7cd3c0dc513bc3cf

SHA1
ec4dda2156d925cfc03d874464e557c4400d44b9

SHA256
5a5ff6683134930d368cfc8ae730a3a1413897a7d309a6b2971e26973b4e4185

SHA512
5dff4054b19848b30ce36db35a2699637237ada2d7d922954201bc82970041b3effc5359e842a9a6f092bcfce36c40442b8a5bf9627af957731d0c2f118a2807

Download Submit
memory/4616-0-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

Filesize
4KB

Download
memory/4616-1-0x0000000000B90000-0x0000000000D22000-memory.dmp

Filesize
1.6MB

Download
memory/4616-2-0x0000000005770000-0x00000000057D6000-memory.dmp

Filesize
408KB

Download
memory/4616-3-0x0000000074D70000-0x0000000075521000-memory.dmp

Filesize
7.7MB

Download
memory/4616-6-0x0000000074D70000-0x0000000075521000-memory.dmp

Filesize
7.7MB

Download