Analysis

  • max time kernel
    10s
  • max time network
    12s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15-09-2024 17:55

General

  • Target

    Stellar.exe

  • Size

    2.4MB

  • MD5

    d68dba883125d1a3408e13b84a3524e1

  • SHA1

    b613717517240829d8c28242a3b2ec7c6576b3f3

  • SHA256

    cc92146cb6e5e514c4bae54ced9f4bf6724b6b8b370f2f6d219aa5b0f95390ba

  • SHA512

    bad82130be599397e7a58a80d8301618fd35787c8d7bf5c1ae0d2cd00f92613265cabd9678c7dcd3e4fe8251a2636b14bdc7d0c0f29e383ae54b5dcf08b30de3

  • SSDEEP

    49152:vMkygnW2WnCzXzf7UPrn2Xb0ThRyUB1CP/yOuUaL4EgfGs3:t7nW2eCzjf7EnNvyCCZeLOG4

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/LsuynkUz

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • AgentTesla payload 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Stellar.exe
    "C:\Users\Admin\AppData\Local\Temp\Stellar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\ProgramData\Stellar Generator.exe
      "C:\ProgramData\Stellar Generator.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1588
    • C:\ProgramData\AdobeIPC.exe
      "C:\ProgramData\AdobeIPC.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2088
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AdobeIPC.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1092
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1056
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AdobeIPC'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:472
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "AdobeIPC" /tr "C:\ProgramData\AdobeIPC"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:900

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\AdobeIPC.exe

    Filesize

    65KB

    MD5

    1f1441f1cc6080cf821cfda93bd05e97

    SHA1

    8949a0762d9b68247d52209653b95f649470deee

    SHA256

    c2b08bb76ce8bbb8d85504b6725bd33e473a591af9bd358286c407b280d07440

    SHA512

    84eeda4e49ceacb5ecc8017e95893d70d52176f973a0e0b1ea1e18098d65164f4a40aeceb17b17a091b288aee0284b60b4cca934cc513039e8736573210133d9

  • C:\ProgramData\Guna.UI2.dll

    Filesize

    2.1MB

    MD5

    c97f23b52087cfa97985f784ea83498f

    SHA1

    d364618bec9cd6f8f5d4c24d3cc0f4c1a8e06b89

    SHA256

    e658e8a5616245dbe655e194b59f1bb704aaeafbd0925d6eebbe70555a638cdd

    SHA512

    ecfa83596f99afde9758d1142ff8b510a090cba6f42ba6fda8ca5e0520b658943ad85829a07bf17411e26e58432b74f05356f7eaeb3949a8834faa5de1a4f512

  • C:\ProgramData\Stellar Generator.exe

    Filesize

    247KB

    MD5

    6b7fce17300b729ca1c919ae47db6c7d

    SHA1

    2e49381b6a922bfaafd040883b04e6a8ab6148b6

    SHA256

    132ee3a204736259c89a6ae74d5c43e832409fa331e39686c6910936a9c7989f

    SHA512

    e9ee8a63e72d6d11d6396a790c61b803df3f20d326cf5279afb4cf88e0838d393f8e0e9d06f27627ad8bdaeddbdb41f996eab6f1a2e2b91c26405e4c1c242f27

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    627073ee3ca9676911bee35548eff2b8

    SHA1

    4c4b68c65e2cab9864b51167d710aa29ebdcff2e

    SHA256

    85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

    SHA512

    3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    1a9fa92a4f2e2ec9e244d43a6a4f8fb9

    SHA1

    9910190edfaccece1dfcc1d92e357772f5dae8f7

    SHA256

    0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

    SHA512

    5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    f8c40f7624e23fa92ae2f41e34cfca77

    SHA1

    20e742cfe2759ac2adbc16db736a9e143ca7b677

    SHA256

    c51a52818a084addbfa913d2bb4bb2b0e60c287a4cf98e679f18b8a521c0aa7b

    SHA512

    f1da3ec61403d788d417d097a7ed2947203c6bff3cf1d35d697c31edecdf04710b3e44b2aa263b886e297b2ce923fea410ccc673261928f1d0cd81252740dbe7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    050567a067ffea4eb40fe2eefebdc1ee

    SHA1

    6e1fb2c7a7976e0724c532449e97722787a00fec

    SHA256

    3952d5b543e5cb0cb84014f4ad9f5f1b7166f592d28640cbc3d914d0e6f41d2e

    SHA512

    341ad71ef7e850b10e229666312e4bca87a0ed9fe25ba4b0ab65661d5a0efa855db0592153106da07134d8fc2c6c0e44709bf38183c9a574a1fa543189971259

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hxorrcqt.opa.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1588-35-0x0000000004DC0000-0x0000000004DCA000-memory.dmp

    Filesize

    40KB

  • memory/1588-33-0x0000000004C20000-0x0000000004CB2000-memory.dmp

    Filesize

    584KB

  • memory/1588-30-0x000000007468E000-0x000000007468F000-memory.dmp

    Filesize

    4KB

  • memory/1588-34-0x0000000074680000-0x0000000074E31000-memory.dmp

    Filesize

    7.7MB

  • memory/1588-88-0x0000000074680000-0x0000000074E31000-memory.dmp

    Filesize

    7.7MB

  • memory/1588-39-0x0000000005900000-0x0000000005B12000-memory.dmp

    Filesize

    2.1MB

  • memory/1588-32-0x0000000005130000-0x00000000056D6000-memory.dmp

    Filesize

    5.6MB

  • memory/1588-87-0x000000007468E000-0x000000007468F000-memory.dmp

    Filesize

    4KB

  • memory/1588-31-0x0000000000270000-0x00000000002B4000-memory.dmp

    Filesize

    272KB

  • memory/2088-45-0x0000015CAD2C0000-0x0000015CAD2E2000-memory.dmp

    Filesize

    136KB

  • memory/2968-0-0x00007FFD59D23000-0x00007FFD59D25000-memory.dmp

    Filesize

    8KB

  • memory/2968-1-0x0000000000890000-0x0000000000AFE000-memory.dmp

    Filesize

    2.4MB

  • memory/4700-85-0x000000001B390000-0x000000001B3A0000-memory.dmp

    Filesize

    64KB

  • memory/4700-86-0x00007FFD59D20000-0x00007FFD5A7E2000-memory.dmp

    Filesize

    10.8MB

  • memory/4700-28-0x00000000005E0000-0x00000000005F6000-memory.dmp

    Filesize

    88KB

  • memory/4700-29-0x00007FFD59D20000-0x00007FFD5A7E2000-memory.dmp

    Filesize

    10.8MB