Analysis

  • max time kernel
    92s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-09-2024 03:31

General

  • Target

    build.exe

  • Size

    1.6MB

  • MD5

    d68ae12f41cab5625775f03155334c9b

  • SHA1

    1bebf42ac39c0eb1cf4cc60fe5f69c0102dadf90

  • SHA256

    210e7db64ff80fa014969eb3705e3b4552ca419968ada35f3940ce979d1e0d00

  • SHA512

    df33322cb9cf4eb927b54f7ce1d1bfe3dc164d3368f52dae0aecee791221824dfb1c580262ff1d5fdbf20b920b709560437b6c193e66791dcd8a0ad5c3b8a0d2

  • SSDEEP

    49152:7kTq24GjdGSiqkqXfd+/9AqYanieKdsn:71EjdGSiqkqXf0FLYW

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1283622190981578844/K30yEdAdRuIKIXwjRibJNrPv8YeY-MquaeyZte1SFFrBxkprI8ktyHemlwHKn1anGJwO

Signatures

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:2968
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Wi-Fi Discovery
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2324
      • C:\Windows\SysWOW64\netsh.exe
        netsh wlan show profile
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Wi-Fi Discovery
        PID:1756
      • C:\Windows\SysWOW64\findstr.exe
        findstr All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:788
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:972
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1212
      • C:\Windows\SysWOW64\netsh.exe
        netsh wlan show networks mode=bssid
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4680
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 1656
      2⤵
      • Program crash
      PID:2080
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3968
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 2968 -ip 2968
    1⤵
      PID:4420

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\24f9574ea5b6e500dba3f47013a032d3\Admin@KVIWLPUJ_en-US\Browsers\Firefox\Bookmarks.txt

      Filesize

      105B

      MD5

      2e9d094dda5cdc3ce6519f75943a4ff4

      SHA1

      5d989b4ac8b699781681fe75ed9ef98191a5096c

      SHA256

      c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

      SHA512

      d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

    • C:\Users\Admin\AppData\Local\24f9574ea5b6e500dba3f47013a032d3\Admin@KVIWLPUJ_en-US\Directories\OneDrive.txt

      Filesize

      25B

      MD5

      966247eb3ee749e21597d73c4176bd52

      SHA1

      1e9e63c2872cef8f015d4b888eb9f81b00a35c79

      SHA256

      8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

      SHA512

      bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

    • C:\Users\Admin\AppData\Local\24f9574ea5b6e500dba3f47013a032d3\Admin@KVIWLPUJ_en-US\Directories\Startup.txt

      Filesize

      24B

      MD5

      68c93da4981d591704cea7b71cebfb97

      SHA1

      fd0f8d97463cd33892cc828b4ad04e03fc014fa6

      SHA256

      889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

      SHA512

      63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

    • C:\Users\Admin\AppData\Local\24f9574ea5b6e500dba3f47013a032d3\Admin@KVIWLPUJ_en-US\Directories\Videos.txt

      Filesize

      23B

      MD5

      1fddbf1169b6c75898b86e7e24bc7c1f

      SHA1

      d2091060cb5191ff70eb99c0088c182e80c20f8c

      SHA256

      a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

      SHA512

      20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

    • C:\Users\Admin\AppData\Local\24f9574ea5b6e500dba3f47013a032d3\Admin@KVIWLPUJ_en-US\System\Apps.txt

      Filesize

      2KB

      MD5

      0cb429893c915be16237a42f5108f0c3

      SHA1

      1c0c808bd64c2ecf00db752b5ecee7d6e238e121

      SHA256

      96109925aea38cf3d8b9fa684fa96253444bf5ac23bf6518df7a98fa3e40dc67

      SHA512

      a2acb30ee767af45cbd00e4e29223dbe99ec26c0f52b92d2bdcd6a042dd75113bc3e3677b1ae115ac52a53fbe45dedbd08b46bdb71c00f9c69ffe25f1101fcff

    • C:\Users\Admin\AppData\Local\24f9574ea5b6e500dba3f47013a032d3\Admin@KVIWLPUJ_en-US\System\Apps.txt

      Filesize

      6KB

      MD5

      68a68b8223626b9e4c828a0fe2699faf

      SHA1

      3694b934ffe211ef5a7c248c4740833507bc4b5f

      SHA256

      4c3263ef73d88e2e506edca81d04ee5f4d38bf8e1a0e2ae7885dfe0d5e686bde

      SHA512

      a95ef42e5dc1269ffbd708bde95ea41dd2ca76ceb1797ce15ea1d305a9dd22e6a0e1cc5da49be6d1aa254303b11391dcdc73b6658fc32e2703bc31fb8624e07a

    • C:\Users\Admin\AppData\Local\24f9574ea5b6e500dba3f47013a032d3\Admin@KVIWLPUJ_en-US\System\Debug.txt

      Filesize

      1007B

      MD5

      b39256260ab4932d118529c04d1ace43

      SHA1

      2e098acddae15b8c1be9c5876e956542fe26381f

      SHA256

      702ec216e26d1a254437ca45b65e906993ecf3a67ecfd3ed76cfea0a7040ffd6

      SHA512

      17d081ed15b017d620818d8a86914b8eacd4e00fee0a898240dce4a35865c3832c07ae2b1b250a13f37bb3af911cdf44e4699b06ff0f76dbb2fa01af7163f510

    • C:\Users\Admin\AppData\Local\24f9574ea5b6e500dba3f47013a032d3\Admin@KVIWLPUJ_en-US\System\Process.txt

      Filesize

      4KB

      MD5

      d18409c7925cd731a4271c4c4246b9c0

      SHA1

      5633820d50955ceaae33cbdcd7c09ac6c252b2d8

      SHA256

      42a5a2250aca12129602d15eb640b058e82657fa68853315a673f4349f9373c2

      SHA512

      67bf6dd5a3ffacb15bd4941cf61bd8c23d49afb7f38f04534063e0cef3610c01d6cdb53197db49a09891c7dddf9fb4bc96e864ab1c35c21e46e95041ffdd9e57

    • C:\Users\Admin\AppData\Local\24f9574ea5b6e500dba3f47013a032d3\Admin@KVIWLPUJ_en-US\System\ProductKey.txt

      Filesize

      29B

      MD5

      71eb5479298c7afc6d126fa04d2a9bde

      SHA1

      a9b3d5505cf9f84bb6c2be2acece53cb40075113

      SHA256

      f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

      SHA512

      7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

    • memory/2968-73-0x00000000081F0000-0x0000000008794000-memory.dmp

      Filesize

      5.6MB

    • memory/2968-204-0x00000000748C0000-0x0000000075070000-memory.dmp

      Filesize

      7.7MB

    • memory/2968-72-0x0000000007600000-0x0000000007692000-memory.dmp

      Filesize

      584KB

    • memory/2968-0-0x00000000748CE000-0x00000000748CF000-memory.dmp

      Filesize

      4KB

    • memory/2968-10-0x0000000007000000-0x0000000007008000-memory.dmp

      Filesize

      32KB

    • memory/2968-9-0x0000000006FF0000-0x0000000006FFA000-memory.dmp

      Filesize

      40KB

    • memory/2968-8-0x00000000060D0000-0x00000000060D8000-memory.dmp

      Filesize

      32KB

    • memory/2968-184-0x00000000748CE000-0x00000000748CF000-memory.dmp

      Filesize

      4KB

    • memory/2968-203-0x0000000007110000-0x000000000718A000-memory.dmp

      Filesize

      488KB

    • memory/2968-11-0x0000000007020000-0x000000000703E000-memory.dmp

      Filesize

      120KB

    • memory/2968-7-0x00000000060A0000-0x00000000060C6000-memory.dmp

      Filesize

      152KB

    • memory/2968-6-0x0000000006010000-0x00000000060A2000-memory.dmp

      Filesize

      584KB

    • memory/2968-3-0x00000000748C0000-0x0000000075070000-memory.dmp

      Filesize

      7.7MB

    • memory/2968-2-0x0000000005A80000-0x0000000005AE6000-memory.dmp

      Filesize

      408KB

    • memory/2968-1-0x0000000000F70000-0x0000000001102000-memory.dmp

      Filesize

      1.6MB

    • memory/2968-277-0x0000000007320000-0x00000000073D2000-memory.dmp

      Filesize

      712KB

    • memory/2968-279-0x00000000748C0000-0x0000000075070000-memory.dmp

      Filesize

      7.7MB