Analysis

  • max time kernel
    125s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 03:30

General

  • Target

    Stub/stub.exe

  • Size

    1.6MB

  • MD5

    02c88fe38285c217f895ff539c631fc5

  • SHA1

    b0d560a11ce564c5272e879f321688b97561f55c

  • SHA256

    7b7fb709fbfa417617beda6fdceb611b51f7d4d76881a106c0edf683fd170e36

  • SHA512

    45498d421c5f13af6382a2ee54c7e2a044a25334c4186450426e52b96c21b9fb97b17d6ddb515f47c9fb19ab5dab37e7bef0cfe0f544f9bb5896ea5ea18c667e

  • SSDEEP

    24576:v4XJi2Q9NXw2/wPOjdGxY2rJxkqjVnlqud+/2P+A+ZecdyFoBkkAqmZywr0G:ZTq24GjdGSiJxkqXfd+/9AqYanCLr

Malware Config

Signatures

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Stub\stub.exe
    "C:\Users\Admin\AppData\Local\Temp\Stub\stub.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3944
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp74DD.tmp.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:896
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
        • System Location Discovery: System Language Discovery
        PID:412
      • C:\Windows\SysWOW64\taskkill.exe
        TaskKill /F /IM 3944
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2120
      • C:\Windows\SysWOW64\timeout.exe
        Timeout /T 2 /Nobreak
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:708
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3364,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
    1⤵
      PID:1604

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp74DD.tmp.bat

      Filesize

      57B

      MD5

      9d1ac778f94fa44e35e38422ffd5b7bb

      SHA1

      24f8cffabee778dae5877eb44acc454a7cc96e9a

      SHA256

      58a3c6f4a8cbe4a01d80d8d0ca07fb111c5d234bdc6f02b83299e6cb241e7d4d

      SHA512

      402f42e5d199a43db41fd62ab722f94982b500e2bad7d07639f6551de06c873913b152b52377a13de5a5f2aeb278eb373cde8a7f019e8f75e05aa475a431cc9b

    • memory/3944-0-0x000000007460E000-0x000000007460F000-memory.dmp

      Filesize

      4KB

    • memory/3944-1-0x0000000000B90000-0x0000000000D26000-memory.dmp

      Filesize

      1.6MB

    • memory/3944-2-0x0000000005570000-0x00000000055D6000-memory.dmp

      Filesize

      408KB

    • memory/3944-3-0x0000000074600000-0x0000000074DB0000-memory.dmp

      Filesize

      7.7MB

    • memory/3944-6-0x0000000074600000-0x0000000074DB0000-memory.dmp

      Filesize

      7.7MB