Analysis
-
max time kernel
93s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2024 04:58
Behavioral task
behavioral1
Sample
build.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
build.exe
Resource
win10v2004-20240802-en
General
-
Target
build.exe
-
Size
1.6MB
-
MD5
bdd8720f26b3c7a8571a19be138d104c
-
SHA1
1703280d57df7ed7f0fb0ba07e4db9e920bc7888
-
SHA256
6e5d248ddb830cd208fc28cd6c8a67f1de3cfc2f08ce17ca6628094ab5b2c0b0
-
SHA512
f66d40d32c72cb4ad4cd0d757e7d7a2265a5a388751fb802a22278e44c6d57145854de403b646cef7b0a12a9ea1d6877628bc640e95626b879337450c001af30
-
SSDEEP
49152:skTq24GjdGSiqkqXfd+/9AqYanieKdsB:s1EjdGSiqkqXf0FLYW
Malware Config
Extracted
stealerium
https://discord.com/api/webhooks/1200737559454699621/mFXBB-ZPPDQWIQJYiv55QprpsoLEFc02oIhLL6DCGzur6yESPcQzMQDCm4PwbSt9Fgxj
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 14 discord.com 15 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 icanhazip.com -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2856 2288 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 3320 cmd.exe 1544 netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 build.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier build.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe 2288 build.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2288 build.exe Token: SeSecurityPrivilege 3136 msiexec.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2288 wrote to memory of 3320 2288 build.exe 91 PID 2288 wrote to memory of 3320 2288 build.exe 91 PID 2288 wrote to memory of 3320 2288 build.exe 91 PID 3320 wrote to memory of 2808 3320 cmd.exe 94 PID 3320 wrote to memory of 2808 3320 cmd.exe 94 PID 3320 wrote to memory of 2808 3320 cmd.exe 94 PID 3320 wrote to memory of 1544 3320 cmd.exe 95 PID 3320 wrote to memory of 1544 3320 cmd.exe 95 PID 3320 wrote to memory of 1544 3320 cmd.exe 95 PID 3320 wrote to memory of 4728 3320 cmd.exe 96 PID 3320 wrote to memory of 4728 3320 cmd.exe 96 PID 3320 wrote to memory of 4728 3320 cmd.exe 96 PID 2288 wrote to memory of 4364 2288 build.exe 99 PID 2288 wrote to memory of 4364 2288 build.exe 99 PID 2288 wrote to memory of 4364 2288 build.exe 99 PID 4364 wrote to memory of 1676 4364 cmd.exe 101 PID 4364 wrote to memory of 1676 4364 cmd.exe 101 PID 4364 wrote to memory of 1676 4364 cmd.exe 101 PID 4364 wrote to memory of 4988 4364 cmd.exe 102 PID 4364 wrote to memory of 4988 4364 cmd.exe 102 PID 4364 wrote to memory of 4988 4364 cmd.exe 102 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 build.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"1⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2288 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:2808
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1544
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
- System Location Discovery: System Language Discovery
PID:4728
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:1676
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4988
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 23282⤵
- Program crash
PID:2856
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2288 -ip 22881⤵PID:1636
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\e15e82b78ec10dc090a906ce30c260c8\Admin@KVIWLPUJ_en-US\Browsers\Firefox\Bookmarks.txt
Filesize105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Local\e15e82b78ec10dc090a906ce30c260c8\Admin@KVIWLPUJ_en-US\Directories\OneDrive.txt
Filesize25B
MD5966247eb3ee749e21597d73c4176bd52
SHA11e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA2568ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
SHA512bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
-
C:\Users\Admin\AppData\Local\e15e82b78ec10dc090a906ce30c260c8\Admin@KVIWLPUJ_en-US\Directories\Startup.txt
Filesize24B
MD568c93da4981d591704cea7b71cebfb97
SHA1fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA256889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
SHA51263455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
-
C:\Users\Admin\AppData\Local\e15e82b78ec10dc090a906ce30c260c8\Admin@KVIWLPUJ_en-US\Directories\Videos.txt
Filesize23B
MD51fddbf1169b6c75898b86e7e24bc7c1f
SHA1d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA256a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
SHA51220bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
-
Filesize
6KB
MD5a6b667345e787fa0e080c06d5cd30de3
SHA18ac8286ef513d9cadb02e3c283a6ae240e34c821
SHA2569a2cf040038eb0b6fd4e5e510f542d13534cfce815fcc9ede759df770ea26de9
SHA512612ac67cbc87c9e2858f5cb16f887baa3c4518a6d83f254db2fd595c669545241c3227efb00db2504cfb2d89e338cc752d1d11d8cd2d91060047e283765789fc
-
Filesize
1KB
MD5ae1bff546d6b04c195dd0609c092b1c6
SHA1555fbfa4ddd7951984edff89551e4d07915c32fb
SHA2561eca902d61918312291a1cd343ad20ecdfc8188f99bf04228cb07979d92ebac6
SHA51272a54593df08b1d9e3dcaf2131eeb2187999090257aed6a4908219259325b2a4662d47c02d9a2de326863ed031b3057f39456731eab6e1ceb8d28970f4d01441
-
C:\Users\Admin\AppData\Local\e15e82b78ec10dc090a906ce30c260c8\Admin@KVIWLPUJ_en-US\System\Process.txt
Filesize4KB
MD5baeb518de7f8c95bd302514d4cf371c7
SHA15cd940d012d1fc68d9c6d70230e7d7b7fc79f30c
SHA2567cc487a521b79831943c1c4ec340f22934cacbdc97222864e9f82cb6a8200088
SHA512b133d70e0c4c36204e62a42f1f8cc44d3a6311d81cfdd9aca2367a1c677929842ea744fb492221ab11b54ca1382551c5393735fcffa3aa9695c7705749818c81
-
C:\Users\Admin\AppData\Local\e15e82b78ec10dc090a906ce30c260c8\Admin@KVIWLPUJ_en-US\System\ProductKey.txt
Filesize29B
MD571eb5479298c7afc6d126fa04d2a9bde
SHA1a9b3d5505cf9f84bb6c2be2acece53cb40075113
SHA256f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
SHA5127c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd