Analysis

  • max time kernel
    36s
  • max time network
    36s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15-09-2024 18:10

General

  • Target

    Stellar.exe

  • Size

    2.4MB

  • MD5

    d68dba883125d1a3408e13b84a3524e1

  • SHA1

    b613717517240829d8c28242a3b2ec7c6576b3f3

  • SHA256

    cc92146cb6e5e514c4bae54ced9f4bf6724b6b8b370f2f6d219aa5b0f95390ba

  • SHA512

    bad82130be599397e7a58a80d8301618fd35787c8d7bf5c1ae0d2cd00f92613265cabd9678c7dcd3e4fe8251a2636b14bdc7d0c0f29e383ae54b5dcf08b30de3

  • SSDEEP

    49152:vMkygnW2WnCzXzf7UPrn2Xb0ThRyUB1CP/yOuUaL4EgfGs3:t7nW2eCzjf7EnNvyCCZeLOG4

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/LsuynkUz

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • AgentTesla payload 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Stellar.exe
    "C:\Users\Admin\AppData\Local\Temp\Stellar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:164
    • C:\ProgramData\Stellar Generator.exe
      "C:\ProgramData\Stellar Generator.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4344
    • C:\ProgramData\AdobeIPC.exe
      "C:\ProgramData\AdobeIPC.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4432
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AdobeIPC.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1820
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\AdobeIPC'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2456
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AdobeIPC'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4220
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "AdobeIPC" /tr "C:\ProgramData\AdobeIPC"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4324
  • C:\ProgramData\AdobeIPC
    C:\ProgramData\AdobeIPC
    1⤵
    • Executes dropped EXE
    PID:2716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\AdobeIPC.exe

    Filesize

    65KB

    MD5

    1f1441f1cc6080cf821cfda93bd05e97

    SHA1

    8949a0762d9b68247d52209653b95f649470deee

    SHA256

    c2b08bb76ce8bbb8d85504b6725bd33e473a591af9bd358286c407b280d07440

    SHA512

    84eeda4e49ceacb5ecc8017e95893d70d52176f973a0e0b1ea1e18098d65164f4a40aeceb17b17a091b288aee0284b60b4cca934cc513039e8736573210133d9

  • C:\ProgramData\Guna.UI2.dll

    Filesize

    2.1MB

    MD5

    c97f23b52087cfa97985f784ea83498f

    SHA1

    d364618bec9cd6f8f5d4c24d3cc0f4c1a8e06b89

    SHA256

    e658e8a5616245dbe655e194b59f1bb704aaeafbd0925d6eebbe70555a638cdd

    SHA512

    ecfa83596f99afde9758d1142ff8b510a090cba6f42ba6fda8ca5e0520b658943ad85829a07bf17411e26e58432b74f05356f7eaeb3949a8834faa5de1a4f512

  • C:\ProgramData\Stellar Generator.exe

    Filesize

    247KB

    MD5

    6b7fce17300b729ca1c919ae47db6c7d

    SHA1

    2e49381b6a922bfaafd040883b04e6a8ab6148b6

    SHA256

    132ee3a204736259c89a6ae74d5c43e832409fa331e39686c6910936a9c7989f

    SHA512

    e9ee8a63e72d6d11d6396a790c61b803df3f20d326cf5279afb4cf88e0838d393f8e0e9d06f27627ad8bdaeddbdb41f996eab6f1a2e2b91c26405e4c1c242f27

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    8592ba100a78835a6b94d5949e13dfc1

    SHA1

    63e901200ab9a57c7dd4c078d7f75dcd3b357020

    SHA256

    fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

    SHA512

    87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    0472cacf6de49cd7a0a67f5f7c240692

    SHA1

    b5d6b9bfac8545ab9b6991d51137deb7039b8614

    SHA256

    5d071ff054756674f5d0fd0142ebbad9cc5cc9574529c8fc1e945c92e27f3c22

    SHA512

    342b3c88d2c55834a57cf45570c23920386488763a0b53d3efd505e3b959d4b83f51ca21db4c1c5a38b3b22173e4d77e9d74503592a37c011216a633b0e217f5

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    e4753c942c6887224bb19c9c3909e69e

    SHA1

    e8fcd502ee1f12a383f1c011b5971016699d2bb1

    SHA256

    d478283046f49d5a0160768562cdded390bfa35bc96713525258326988b4280a

    SHA512

    95fa17cf724728641e64a6a91f46d676a66d69dde33fc28fedca11574a785c02249d96323e37ece922f165b7e161a7aea8ab84388325cddca6212abfa2354bc2

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    a953721d088e3d07456fdfca2220f99c

    SHA1

    5b12aded20d8ab611f9e8fa25d458f9ef0f91a72

    SHA256

    7dcf742206203a1a98cc04e546ae8482a43e6c1a449e34fb1f5a97b414af66e4

    SHA512

    77564f706ffda97a399c1c06b12774385f2f4a64c74037069c6d2549dc5bf127b5f70bfaefb30b0e76a9aae360131b4203e2fd2de2a8b6ff89cc420b63a3fb18

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c1maty41.m5m.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • memory/164-1-0x0000000000650000-0x00000000008BE000-memory.dmp

    Filesize

    2.4MB

  • memory/164-0-0x00007FF8C9B73000-0x00007FF8C9B74000-memory.dmp

    Filesize

    4KB

  • memory/2764-238-0x000000001B490000-0x000000001B4A0000-memory.dmp

    Filesize

    64KB

  • memory/2764-206-0x000000001B490000-0x000000001B4A0000-memory.dmp

    Filesize

    64KB

  • memory/2764-18-0x00000000007D0000-0x00000000007E6000-memory.dmp

    Filesize

    88KB

  • memory/2764-17-0x00007FF8C9B73000-0x00007FF8C9B74000-memory.dmp

    Filesize

    4KB

  • memory/4344-16-0x000000007320E000-0x000000007320F000-memory.dmp

    Filesize

    4KB

  • memory/4344-27-0x0000000005CB0000-0x0000000005EC2000-memory.dmp

    Filesize

    2.1MB

  • memory/4344-23-0x0000000005460000-0x000000000546A000-memory.dmp

    Filesize

    40KB

  • memory/4344-19-0x0000000000B10000-0x0000000000B54000-memory.dmp

    Filesize

    272KB

  • memory/4344-22-0x0000000005380000-0x0000000005390000-memory.dmp

    Filesize

    64KB

  • memory/4344-21-0x00000000053A0000-0x0000000005432000-memory.dmp

    Filesize

    584KB

  • memory/4344-207-0x000000007320E000-0x000000007320F000-memory.dmp

    Filesize

    4KB

  • memory/4344-208-0x0000000005380000-0x0000000005390000-memory.dmp

    Filesize

    64KB

  • memory/4344-20-0x00000000057B0000-0x0000000005CAE000-memory.dmp

    Filesize

    5.0MB

  • memory/4432-35-0x000001B87FB40000-0x000001B87FBB6000-memory.dmp

    Filesize

    472KB

  • memory/4432-32-0x000001B87F980000-0x000001B87F9A2000-memory.dmp

    Filesize

    136KB