Analysis
-
max time kernel
95s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2024 04:56
Behavioral task
behavioral1
Sample
stub.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
stub.exe
Resource
win10v2004-20240802-en
General
-
Target
stub.exe
-
Size
1.6MB
-
MD5
6627adf7167ee571e8fd6c8b1a0e8ae3
-
SHA1
03b9112660ee73c59d84e219f15bf24ae9df48db
-
SHA256
6c5935bcddaa1d4f809487f66db758e892cc0a7fd7704d138904bc879644ea1f
-
SHA512
e05896a6e0d09d4dafeb2467395ca06ae1e728a4aa079041dea82940caeb71646984604fdeea482748423b10257b8462db4f573682f9f719939143fdb5691c60
-
SSDEEP
49152:19Tq24GjdGSiqkqXfd+/9AqYanieKd0U:1YEjdGSiqkqXf0FLYW
Malware Config
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation stub.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stub.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4048 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 4980 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3752 stub.exe Token: SeDebugPrivilege 4980 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3752 wrote to memory of 4616 3752 stub.exe 89 PID 3752 wrote to memory of 4616 3752 stub.exe 89 PID 3752 wrote to memory of 4616 3752 stub.exe 89 PID 4616 wrote to memory of 2604 4616 cmd.exe 91 PID 4616 wrote to memory of 2604 4616 cmd.exe 91 PID 4616 wrote to memory of 2604 4616 cmd.exe 91 PID 4616 wrote to memory of 4980 4616 cmd.exe 92 PID 4616 wrote to memory of 4980 4616 cmd.exe 92 PID 4616 wrote to memory of 4980 4616 cmd.exe 92 PID 4616 wrote to memory of 4048 4616 cmd.exe 93 PID 4616 wrote to memory of 4048 4616 cmd.exe 93 PID 4616 wrote to memory of 4048 4616 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\stub.exe"C:\Users\Admin\AppData\Local\Temp\stub.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp402.tmp.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:2604
-
-
C:\Windows\SysWOW64\taskkill.exeTaskKill /F /IM 37523⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
-
C:\Windows\SysWOW64\timeout.exeTimeout /T 2 /Nobreak3⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4048
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57B
MD548cfe00dce2d5416651b2468a07a889f
SHA181d88bff0667e5661a6d0c13ff10cc59954b8e8e
SHA256575c68c7d06d1b68e21b2957ecc979089520fcff26e2311c0e88b017219899b0
SHA5126e49973d8867e9a2c732f7d608faec557647e3d14781ed3fb29be975154c05a101b13e40e6831766d38c4c8123761c7608bfb291fff519fd30b1608505cadf01