Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02-09-2024 04:58
Behavioral task
behavioral1
Sample
Injector.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Injector.exe
Resource
win10v2004-20240802-en
General
-
Target
Injector.exe
-
Size
1.6MB
-
MD5
918c252b78b639ddce9c4023f9a40d93
-
SHA1
5c32034d22a1ab09b4348cef80c27c5841ea878b
-
SHA256
e4bc0cf72cdfd48082fbf9adfcae35a6029e4f4d088357bbd08aa6cdb327df36
-
SHA512
be50fecda626becfe6ff84be2e1194c31afa2ded920585f4c29b58ff970a1e2a1663b55dd0a389c8a53e9f6b922a3bef654a0841886ec6aba4faaf21ad4fd759
-
SSDEEP
49152:LkTq24GjdGSiqkqXfd+/9AqYanieKdsV:L1EjdGSiqkqXf0FLYW
Malware Config
Extracted
stealerium
https://discord.com/api/webhooks/1199670856528441364/rz5aPuXxX-cJ3WXixw5lOIE4JascnyylRnrM9_6xbRGWJRsor4pBj8EmtRCX0s3ZuV_w
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Injector.exe Key opened \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Injector.exe Key opened \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Injector.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 discord.com 5 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 icanhazip.com -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 332 1404 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Injector.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 1984 cmd.exe 3028 netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 Injector.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Injector.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1404 Injector.exe 1404 Injector.exe 1404 Injector.exe 1404 Injector.exe 1404 Injector.exe 1404 Injector.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1404 Injector.exe Token: SeRestorePrivilege 2104 msiexec.exe Token: SeTakeOwnershipPrivilege 2104 msiexec.exe Token: SeSecurityPrivilege 2104 msiexec.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1404 wrote to memory of 1984 1404 Injector.exe 31 PID 1404 wrote to memory of 1984 1404 Injector.exe 31 PID 1404 wrote to memory of 1984 1404 Injector.exe 31 PID 1404 wrote to memory of 1984 1404 Injector.exe 31 PID 1984 wrote to memory of 3020 1984 cmd.exe 33 PID 1984 wrote to memory of 3020 1984 cmd.exe 33 PID 1984 wrote to memory of 3020 1984 cmd.exe 33 PID 1984 wrote to memory of 3020 1984 cmd.exe 33 PID 1984 wrote to memory of 3028 1984 cmd.exe 34 PID 1984 wrote to memory of 3028 1984 cmd.exe 34 PID 1984 wrote to memory of 3028 1984 cmd.exe 34 PID 1984 wrote to memory of 3028 1984 cmd.exe 34 PID 1984 wrote to memory of 1416 1984 cmd.exe 35 PID 1984 wrote to memory of 1416 1984 cmd.exe 35 PID 1984 wrote to memory of 1416 1984 cmd.exe 35 PID 1984 wrote to memory of 1416 1984 cmd.exe 35 PID 1404 wrote to memory of 1108 1404 Injector.exe 36 PID 1404 wrote to memory of 1108 1404 Injector.exe 36 PID 1404 wrote to memory of 1108 1404 Injector.exe 36 PID 1404 wrote to memory of 1108 1404 Injector.exe 36 PID 1108 wrote to memory of 1524 1108 cmd.exe 38 PID 1108 wrote to memory of 1524 1108 cmd.exe 38 PID 1108 wrote to memory of 1524 1108 cmd.exe 38 PID 1108 wrote to memory of 1524 1108 cmd.exe 38 PID 1108 wrote to memory of 1048 1108 cmd.exe 39 PID 1108 wrote to memory of 1048 1108 cmd.exe 39 PID 1108 wrote to memory of 1048 1108 cmd.exe 39 PID 1108 wrote to memory of 1048 1108 cmd.exe 39 PID 1404 wrote to memory of 332 1404 Injector.exe 41 PID 1404 wrote to memory of 332 1404 Injector.exe 41 PID 1404 wrote to memory of 332 1404 Injector.exe 41 PID 1404 wrote to memory of 332 1404 Injector.exe 41 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Injector.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Injector.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Injector.exe"C:\Users\Admin\AppData\Local\Temp\Injector.exe"1⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1404 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:3020
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3028
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
- System Location Discovery: System Language Discovery
PID:1416
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:1524
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1048
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 26202⤵
- Program crash
PID:332
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2104
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
C:\Users\Admin\AppData\Local\f457c3168b63b786ea528bcc489971f4\Admin@MGWWAYYN_en-US\Browsers\Firefox\Bookmarks.txt
Filesize105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Local\f457c3168b63b786ea528bcc489971f4\Admin@MGWWAYYN_en-US\Directories\Startup.txt
Filesize24B
MD568c93da4981d591704cea7b71cebfb97
SHA1fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA256889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
SHA51263455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
-
C:\Users\Admin\AppData\Local\f457c3168b63b786ea528bcc489971f4\Admin@MGWWAYYN_en-US\Directories\Videos.txt
Filesize23B
MD51fddbf1169b6c75898b86e7e24bc7c1f
SHA1d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA256a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
SHA51220bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
-
Filesize
6KB
MD53e7cd8343dbee80ec90e77c0e97e365a
SHA17b5b5ba892a026b5b842fe9431b5481bce47e2eb
SHA256186eae1850b611f54f5b771e2792080a82144302021ef63563e8f489b79a30a1
SHA512cf8e282f160024fc0616c468ec20b1c49eb23d71c3c8930a31a50b282e366b5351e12bb44b2f1eda13abdfa11d7ea2c36505c4bb751b43946a5649c21f4869c7
-
C:\Users\Admin\AppData\Local\f457c3168b63b786ea528bcc489971f4\Admin@MGWWAYYN_en-US\System\ProductKey.txt
Filesize29B
MD5cad6c6bee6c11c88f5e2f69f0be6deb7
SHA1289d74c3bebe6cca4e1d2e084482ad6d21316c84
SHA256dc288491fadc4a85e71085890e3d6a7746e99a317cd5ef09a30272dfb10398c0
SHA512e02cf6bff8b4ebd7a1346ecb1667be36c3ef7415fff77c3b9cfb370f3d0dc861f74d3e0e49065699850ba6cc025cd68d14ceb73f3b512c2a9b28873a69aff097