Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
04-07-2024 03:03
General
-
Target
Message_20240703082651_snippa/Message_20240703082651_snippa.wav.exe
-
Size
2.2MB
-
MD5
b862a2b99c3968173b3de780bd696027
-
SHA1
7531769525187639f1530b42f221ad1a9b189a8f
-
SHA256
e600f4c6b7476c6a87f2cb342b46e0e7b96790c2b25448af030e866b71f2b4b6
-
SHA512
9bec24ed3dfdb71c8433a8fb2923423c543554e484b77c7a15c344e66d2c840188e0e4f87582a32a00580df4e5cb89d62b54892d3f9b19a671bde668fff5fb8e
-
SSDEEP
49152:cJuGb6/6D58MO8qA3hRg+Egv9LPb0S7CmeULsPy8x11eIwhmX6c:cJJW/6W8hheEvRPPP3cy6woX6
Malware Config
Extracted
stealerium
https://discord.com/api/webhooks/1257666720059883600/GpvO8nlJrX2Jfw18M2Dv1On2EhjpqEV6IdGUgDeaq1dyExXmT-HJ2LXpbfIs34JU1GkX
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 29 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid4⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3708,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:81⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
25B
MD5966247eb3ee749e21597d73c4176bd52
SHA11e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA2568ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
SHA512bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
-
Filesize
24B
MD568c93da4981d591704cea7b71cebfb97
SHA1fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA256889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
SHA51263455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
-
Filesize
23B
MD51fddbf1169b6c75898b86e7e24bc7c1f
SHA1d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA256a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
SHA51220bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
-
Filesize
6KB
MD59457e33e423499ff2c430759b16894f4
SHA121e354016e51f5c7bcba7b4f94cc0995b2d5a602
SHA256b195ecbff8e1008ec2eec0731f58701b16ee655832623e6a8151ffca3aa0bf54
SHA512417e7467bc44077a2a312524b963160212b58b46646bee487e7b01c6038413d6df8bb008c93358b51457a70119057df6fe43991cf662a225bd00daabe3ad02e8
-
Filesize
1KB
MD584d34a6bad4e1058259547e95d854f76
SHA1d3fbfa78a680f4a43e79388697b239923203e4bd
SHA25600083e90f71e126a4643a0554568fd52a5297822a93c5097198758f6c28b188b
SHA51224d7d8862fc5eec2fb17fead68afbcc3c917ea93d37dea571edd50e4faa9caa6f9ac4a06ea91b12b93bb8e1602280d34991c39375e10146cd93e3f3becadc3a6
-
Filesize
4KB
MD543005f85b54603575bc76756d7f96dab
SHA1ba3004dc77fd9dabfbeb7fd3472a5d693018d94c
SHA256788e5f5d6f8a54cc3bbe5d3de146626fce2d1157a0ea9cadcf735535c3337b8a
SHA51217fea1d36944bbc0eae5dc83697aa2bcc47b529de69af74b611b883fd51966f8e82b9a3a0362586c7ca8e291b28ae89ae92eddb382c060cf8b9783a3aca41d9c
-
Filesize
29B
MD571eb5479298c7afc6d126fa04d2a9bde
SHA1a9b3d5505cf9f84bb6c2be2acece53cb40075113
SHA256f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
SHA5127c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd
-
Filesize
19B
MD5b2ed68e6952edeb45b4df70e9015615f
SHA1607d411be54abec791fa7db8ad2f7480c3b2bf78
SHA256cbaf49ed2ca0e2a1918512b78262e16e751e380d32d3f7d342bc9f77a4b10957
SHA5127a2fb1dbd61709e094af5be5d4df8ab7dc8bfe52186d14d6d70691cc67a90464bb00d732da1c499eddddf2bd4caf2ab502346ab1bfda025bad4676537d09e569
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
1.8MB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
624KB
-
Filesize
104KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
2.2MB
-
Filesize
584KB
-
Filesize
120KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
488KB
-
Filesize
32KB
-
Filesize
152KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
712KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
1.6MB
-
Filesize
7.7MB
-
Filesize
7.7MB