Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2024 13:59
Behavioral task
behavioral1
Sample
c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe
Resource
win10v2004-20240802-en
General
-
Target
c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe
-
Size
1.6MB
-
MD5
96c62ca985ed966d7c6d274caa5bb41a
-
SHA1
97842b7b0d381ae027f8a92787ffff84eca2a698
-
SHA256
c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa
-
SHA512
66e086fdd0f39f0f166c3d9253805de4095e95b47eee38393a113e2279d4f90c13c8584f3827f45c85b2bca71a9119a48dca6f59d006d4015e9c2f6dafedcde5
-
SSDEEP
49152:LkTq24GjdGSiqkqXfd+/9AqYanieKdsG:L1EjdGSiqkqXf0FLYW
Malware Config
Extracted
stealerium
https://discord.com/api/webhooks/1216977598710812722/eEJiGM8jVlIOF9WMbphPIuNdIEZhhSSu4T_LZSo0WE_S2YnMqS8z5lz1bmAKfC9V08aI
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 14 discord.com 15 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2316 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 228 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2444 c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2444 c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe Token: SeDebugPrivilege 228 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2444 wrote to memory of 640 2444 c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe 90 PID 2444 wrote to memory of 640 2444 c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe 90 PID 2444 wrote to memory of 640 2444 c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe 90 PID 640 wrote to memory of 2464 640 cmd.exe 92 PID 640 wrote to memory of 2464 640 cmd.exe 92 PID 640 wrote to memory of 2464 640 cmd.exe 92 PID 640 wrote to memory of 228 640 cmd.exe 93 PID 640 wrote to memory of 228 640 cmd.exe 93 PID 640 wrote to memory of 228 640 cmd.exe 93 PID 640 wrote to memory of 2316 640 cmd.exe 94 PID 640 wrote to memory of 2316 640 cmd.exe 94 PID 640 wrote to memory of 2316 640 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe"C:\Users\Admin\AppData\Local\Temp\c1cf23cf49d7406b02b538db9d9636209c706d3f2fd9719bfda55aef5f65cbaa.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpB9AB.tmp.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:2464
-
-
C:\Windows\SysWOW64\taskkill.exeTaskKill /F /IM 24443⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:228
-
-
C:\Windows\SysWOW64\timeout.exeTimeout /T 2 /Nobreak3⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2316
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57B
MD5c034df2a7f59eb18ed91797320398249
SHA125acbfcf0e23688207f8ce11537a020ed39ed41c
SHA25694e848f63b0525e7d4283636c63d0c91ed465c59b2bff6f8347320e782e2b4e6
SHA512eddd307f380fa2a85ddb90739de97a7da9f4bdaab1f227c7bf74929d9f734979f4c5a27241d51c062d929ac4b88b55acc8fde90c85cb60327867a420db26dc37