Analysis

  • max time kernel
    75s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-09-2024 08:42

General

  • Target

    60cba219e4f5f5869a14e642b08f478e0f4916ffc6c6cdc5e4d6e397d2ae86afN.exe

  • Size

    1.6MB

  • MD5

    43f0aa823c23bb7241d631c14353f110

  • SHA1

    349f02fca22a5e95c431eef311a1bfec0fc22f2f

  • SHA256

    60cba219e4f5f5869a14e642b08f478e0f4916ffc6c6cdc5e4d6e397d2ae86af

  • SHA512

    d9a61f7af251d24a134ea6ff620577cd739a3df2946b7c22716dcb63cc3df8e03b8095d2960142abbd93d5b5b2e86afa863184bbbaee31862bdc359d172780a4

  • SSDEEP

    49152:hkTq24GjdGSiqkqXfd+/9AqYanieKdsI:h1EjdGSiqkqXf0FLYW

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1225052212011470899/G0QJCuCgsewiboSGsbwt30FSVi0QRAkc24PebWUdSTCst5Nh7j1voGoejqgwmabOAKQ6

Signatures

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\60cba219e4f5f5869a14e642b08f478e0f4916ffc6c6cdc5e4d6e397d2ae86afN.exe
    "C:\Users\Admin\AppData\Local\Temp\60cba219e4f5f5869a14e642b08f478e0f4916ffc6c6cdc5e4d6e397d2ae86afN.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpF697.tmp.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2924
      • C:\Windows\SysWOW64\taskkill.exe
        TaskKill /F /IM 1940
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2928
      • C:\Windows\SysWOW64\timeout.exe
        Timeout /T 2 /Nobreak
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:1356

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabF50B.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarF52D.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\tmpF697.tmp.bat

    Filesize

    57B

    MD5

    e480af4fe95a4e56acedfdb80a8dcc0c

    SHA1

    86c376691e515080fd4b02694ded267401be3546

    SHA256

    e337b9ffdd3ce0ee7d52dd379b5a83335f030b1e965d3e10a0230cffc1e6d1be

    SHA512

    9cd78e5357af2e04c54207af09422315fb0699069b291b1d48595f2530bdead40c5d4451c97474a6d22aec043874ae2ffd90fca4900fe036bdd5999b381b7d68

  • memory/1940-0-0x000000007443E000-0x000000007443F000-memory.dmp

    Filesize

    4KB

  • memory/1940-1-0x0000000000C30000-0x0000000000DC2000-memory.dmp

    Filesize

    1.6MB

  • memory/1940-2-0x0000000074430000-0x0000000074B1E000-memory.dmp

    Filesize

    6.9MB

  • memory/1940-5-0x00000000051D0000-0x0000000005262000-memory.dmp

    Filesize

    584KB

  • memory/1940-6-0x0000000000A00000-0x0000000000A26000-memory.dmp

    Filesize

    152KB

  • memory/1940-7-0x0000000000A30000-0x0000000000A38000-memory.dmp

    Filesize

    32KB

  • memory/1940-46-0x0000000074430000-0x0000000074B1E000-memory.dmp

    Filesize

    6.9MB