Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22-09-2024 20:23

General

  • Target

    build.exe

  • Size

    1.6MB

  • MD5

    3923d76c1bdc19346db7ef3ce7ecf39d

  • SHA1

    209e93526f1eed8b0a33ed1cf62bd9f6c8ef04e7

  • SHA256

    434b24ee97a727982a127dbf28d5b3b938e8589e69d92f57ffb5ed4cdf51b305

  • SHA512

    8b0cc22caa18b1a01f8e3d86323965f4db051654e8dcea9ee49edc7a3fdf0f12e5a53c53d5686b49988d13be437dcb82707010b171b01262903a7bbd09d4ff1d

  • SSDEEP

    24576:si2Q9NXw2/wPOjdGxY2rJxkqjVnlqud+/2P+A+ZecdyFoBkkAqmZywp0/:DTq24GjdGSiJxkqXfd+/9AqYanCLp

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1287506826279129221/xtmBrxjVwk8CNmFFCmP-CL8-wWbVTomW26j6YFaob_78SA4yDnROH_sKo1BzgFFsDc6e

Signatures

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:3920
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Wi-Fi Discovery
      • Suspicious use of WriteProcessMemory
      PID:3576
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4644
      • C:\Windows\SysWOW64\netsh.exe
        netsh wlan show profile
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Wi-Fi Discovery
        PID:3228
      • C:\Windows\SysWOW64\findstr.exe
        findstr All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3348
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4044
      • C:\Windows\SysWOW64\netsh.exe
        netsh wlan show networks mode=bssid
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2076
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp1B60.tmp.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3344
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3144
      • C:\Windows\SysWOW64\taskkill.exe
        TaskKill /F /IM 3920
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2364
      • C:\Windows\SysWOW64\timeout.exe
        Timeout /T 2 /Nobreak
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:3348
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp1B60.tmp.bat

    Filesize

    57B

    MD5

    baab4e4eb1b77939e0148f0b90d324b5

    SHA1

    7a1d0e0d6963e3a1366c435c13c23d5f87510d66

    SHA256

    f40f4b6c52bc74d009c736d35d1c87c800ce5c92930db85fc4d8e6b7baac0cd7

    SHA512

    b31558c8311757121ce89295cffd6c6473636005edeb80ae68f124385aa9a554bd4f5fec89689ae09265aaaf7a31bfb2d9402d63530f98f418003dd7b8a79d4f

  • C:\Users\Admin\AppData\Local\c874bf29084fdefd3f3457e6f1b1330c\Admin@NPCDUADC_en-US\Browsers\Firefox\Bookmarks.txt

    Filesize

    105B

    MD5

    2e9d094dda5cdc3ce6519f75943a4ff4

    SHA1

    5d989b4ac8b699781681fe75ed9ef98191a5096c

    SHA256

    c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

    SHA512

    d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

  • C:\Users\Admin\AppData\Local\c874bf29084fdefd3f3457e6f1b1330c\Admin@NPCDUADC_en-US\Directories\OneDrive.txt

    Filesize

    25B

    MD5

    966247eb3ee749e21597d73c4176bd52

    SHA1

    1e9e63c2872cef8f015d4b888eb9f81b00a35c79

    SHA256

    8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

    SHA512

    bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

  • C:\Users\Admin\AppData\Local\c874bf29084fdefd3f3457e6f1b1330c\Admin@NPCDUADC_en-US\Directories\Startup.txt

    Filesize

    24B

    MD5

    68c93da4981d591704cea7b71cebfb97

    SHA1

    fd0f8d97463cd33892cc828b4ad04e03fc014fa6

    SHA256

    889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

    SHA512

    63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

  • C:\Users\Admin\AppData\Local\c874bf29084fdefd3f3457e6f1b1330c\Admin@NPCDUADC_en-US\Directories\Videos.txt

    Filesize

    23B

    MD5

    1fddbf1169b6c75898b86e7e24bc7c1f

    SHA1

    d2091060cb5191ff70eb99c0088c182e80c20f8c

    SHA256

    a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

    SHA512

    20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

  • C:\Users\Admin\AppData\Local\c874bf29084fdefd3f3457e6f1b1330c\Admin@NPCDUADC_en-US\System\Apps.txt

    Filesize

    1KB

    MD5

    672e0b47e4b4223264ba69dc7c8dd46b

    SHA1

    ceddff132da98cc65ca4880223bc713c0ee9958b

    SHA256

    c4b90343a895873725d00235136224359178e96c95f358e11347f1de2184be2a

    SHA512

    f46c8c395eef806dcf5eda982992b580646904e5919604a8ad55359650f63c8bde2adff491a8577acdf15a55be3f9f46faf0d4197bf66545014a3572cc5e6d6d

  • C:\Users\Admin\AppData\Local\c874bf29084fdefd3f3457e6f1b1330c\Admin@NPCDUADC_en-US\System\Apps.txt

    Filesize

    6KB

    MD5

    75f8252b8fe2f717259c3fd8c976b63d

    SHA1

    a394178778b387493861fd6eef1d382e98453da1

    SHA256

    b14f4d4aa92f5bbe08cff52fcaa01536ea6d0defedf4609d387c51c33f8ca4d2

    SHA512

    551c49bb352469f238b721a103637f37e038d82420463c662ce5f6f484f95e384e91203b127a62993b9267ca1716d57e0b583d750e6be182bb3d7fb802e4b9ba

  • C:\Users\Admin\AppData\Local\c874bf29084fdefd3f3457e6f1b1330c\Admin@NPCDUADC_en-US\System\Debug.txt

    Filesize

    1KB

    MD5

    06e01737de65de82fc4e14ba3c7ed419

    SHA1

    e1ecdd1ecdf6e5b5bf649aa1d5f6f459c31cffa0

    SHA256

    cbf90019469ddaaaee95bfa6110288cf566b48fb47005a69c1e4c007e9f1f3c7

    SHA512

    121f206952d1588c81a88502a7358740f292af1513f0baf24c918d1d7309e42904122b1ae8a36b81f7ff511b45efab60eb05f7028fffc37ce1c12cfd2f5758ff

  • C:\Users\Admin\AppData\Local\c874bf29084fdefd3f3457e6f1b1330c\Admin@NPCDUADC_en-US\System\Process.txt

    Filesize

    4KB

    MD5

    0be0eefad8f687ca7de6ffbfc3add91b

    SHA1

    3a29365d312dead7a9207ec65cc84b54d2298ae0

    SHA256

    8c565f593fa436fc1ff6b323b7c586a4289604117535f244bab00e2c2d71cf6e

    SHA512

    4a2c69b1ce8b1d9b716e3be458bd74a2a3d62e84ac6011c724742706f2d9116b98dca832f7ede9d6fbf928f5ef97a96f58fe2bc1ee8d78eca462afd7213f70f9

  • C:\Users\Admin\AppData\Local\c874bf29084fdefd3f3457e6f1b1330c\Admin@NPCDUADC_en-US\System\ProductKey.txt

    Filesize

    29B

    MD5

    71eb5479298c7afc6d126fa04d2a9bde

    SHA1

    a9b3d5505cf9f84bb6c2be2acece53cb40075113

    SHA256

    f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

    SHA512

    7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

  • C:\Users\Admin\AppData\Local\c874bf29084fdefd3f3457e6f1b1330c\msgid.dat

    Filesize

    19B

    MD5

    371a740a1dd72ec83bcdf541b5389a1a

    SHA1

    8d277ab525874b7c10b9bc4154221e039ec69812

    SHA256

    f3378d47d5d3d0bcdf11bb6dbe62f931f8e5188ef49defb3dfa8fbc3a7e19b42

    SHA512

    77c9a82cf6f37473df59c2c93ad9c1785cfd73cece3842f5dacc4f272d65620ccbccfaff56db7cf22e2704a2efb0b5ecc8b923269a1f80a443dc45c94c19970d

  • memory/3920-8-0x00000000746A0000-0x0000000074E51000-memory.dmp

    Filesize

    7.7MB

  • memory/3920-7-0x00000000746AE000-0x00000000746AF000-memory.dmp

    Filesize

    4KB

  • memory/3920-73-0x0000000007B90000-0x0000000008136000-memory.dmp

    Filesize

    5.6MB

  • memory/3920-0-0x00000000746AE000-0x00000000746AF000-memory.dmp

    Filesize

    4KB

  • memory/3920-10-0x0000000005DB0000-0x0000000005DD6000-memory.dmp

    Filesize

    152KB

  • memory/3920-9-0x0000000005D10000-0x0000000005DB0000-memory.dmp

    Filesize

    640KB

  • memory/3920-194-0x0000000006D70000-0x0000000006DEA000-memory.dmp

    Filesize

    488KB

  • memory/3920-11-0x0000000006BE0000-0x0000000006BEA000-memory.dmp

    Filesize

    40KB

  • memory/3920-12-0x0000000006BF0000-0x0000000006BF8000-memory.dmp

    Filesize

    32KB

  • memory/3920-70-0x0000000007300000-0x0000000007392000-memory.dmp

    Filesize

    584KB

  • memory/3920-3-0x00000000746A0000-0x0000000074E51000-memory.dmp

    Filesize

    7.7MB

  • memory/3920-2-0x00000000056C0000-0x0000000005726000-memory.dmp

    Filesize

    408KB

  • memory/3920-263-0x0000000007160000-0x0000000007212000-memory.dmp

    Filesize

    712KB

  • memory/3920-265-0x0000000007210000-0x0000000007232000-memory.dmp

    Filesize

    136KB

  • memory/3920-266-0x0000000008140000-0x0000000008497000-memory.dmp

    Filesize

    3.3MB

  • memory/3920-13-0x0000000006C10000-0x0000000006C2E000-memory.dmp

    Filesize

    120KB

  • memory/3920-1-0x0000000000A90000-0x0000000000C26000-memory.dmp

    Filesize

    1.6MB

  • memory/3920-280-0x00000000746A0000-0x0000000074E51000-memory.dmp

    Filesize

    7.7MB