stealerium | 49d8c623abc37dff7af7d7ea15fa66b27504f166b5bf7a2d486c41ce7923a722

Resubmissions

28/05/2024, 15:28

240528-swf9tsbd55 10

28/05/2024, 15:26

240528-svjnkabd22 10

Analysis

max time kernel
90s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
28/05/2024, 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stub/stub.exe
Size

1.6MB
MD5

6627adf7167ee571e8fd6c8b1a0e8ae3
SHA1

03b9112660ee73c59d84e219f15bf24ae9df48db
SHA256

6c5935bcddaa1d4f809487f66db758e892cc0a7fd7704d138904bc879644ea1f
SHA512

e05896a6e0d09d4dafeb2467395ca06ae1e728a4aa079041dea82940caeb71646984604fdeea482748423b10257b8462db4f573682f9f719939143fdb5691c60
SSDEEP

49152:19Tq24GjdGSiqkqXfd+/9AqYanieKd0U:1YEjdGSiqkqXf0FLYW

Score

10^/10

stealerium stealer

Malware Config

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3092	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2036	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	stub.exe
Token: SeDebugPrivilege	2036	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4104	4616	stub.exe	77
PID 4616 wrote to memory of 4104	4616	stub.exe	77
PID 4616 wrote to memory of 4104	4616	stub.exe	77
PID 4104 wrote to memory of 4564	4104	cmd.exe	79
PID 4104 wrote to memory of 4564	4104	cmd.exe	79
PID 4104 wrote to memory of 4564	4104	cmd.exe	79
PID 4104 wrote to memory of 2036	4104	cmd.exe	80
PID 4104 wrote to memory of 2036	4104	cmd.exe	80
PID 4104 wrote to memory of 2036	4104	cmd.exe	80
PID 4104 wrote to memory of 3092	4104	cmd.exe	81
PID 4104 wrote to memory of 3092	4104	cmd.exe	81
PID 4104 wrote to memory of 3092	4104	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\Stub\stub.exe
"C:\Users\Admin\AppData\Local\Temp\Stub\stub.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5A93.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\taskkill.exe
    TaskKill /F /IM 4616
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- - C:\Windows\SysWOW64\timeout.exe
    Timeout /T 2 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5A93.tmp.bat

Filesize
57B

MD5
75b1e9263fc7b98d7cd3c0dc513bc3cf

SHA1
ec4dda2156d925cfc03d874464e557c4400d44b9

SHA256
5a5ff6683134930d368cfc8ae730a3a1413897a7d309a6b2971e26973b4e4185

SHA512
5dff4054b19848b30ce36db35a2699637237ada2d7d922954201bc82970041b3effc5359e842a9a6f092bcfce36c40442b8a5bf9627af957731d0c2f118a2807

Download Submit
memory/4616-0-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

Filesize
4KB

Download
memory/4616-1-0x0000000000B90000-0x0000000000D22000-memory.dmp

Filesize
1.6MB

Download
memory/4616-2-0x0000000005770000-0x00000000057D6000-memory.dmp

Filesize
408KB

Download
memory/4616-3-0x0000000074D70000-0x0000000075521000-memory.dmp

Filesize
7.7MB

Download
memory/4616-6-0x0000000074D70000-0x0000000075521000-memory.dmp

Filesize
7.7MB

Download