stealerium | hxxps://gofile[.]io/d/VS2mj2

General

Target

https://gofile.io/d/VS2mj2

Score

10^/10

stealerium discovery stealer

Malware Config

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	MERCURY.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	MERCURY.exe

Executes dropped EXE 2 IoCs

pid	Process
740	MERCURY.exe
3396	MERCURY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MERCURY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MERCURY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1968	timeout.exe
1072	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
3888	taskkill.exe
1168	taskkill.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	4132	7zG.exe
Token: 35	4132	7zG.exe
Token: SeSecurityPrivilege	4132	7zG.exe
Token: SeSecurityPrivilege	4132	7zG.exe
Token: SeDebugPrivilege	740	MERCURY.exe
Token: SeDebugPrivilege	3888	taskkill.exe
Token: SeDebugPrivilege	3396	MERCURY.exe
Token: SeDebugPrivilege	1168	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4132	7zG.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 640	740	MERCURY.exe	116
PID 740 wrote to memory of 640	740	MERCURY.exe	116
PID 740 wrote to memory of 640	740	MERCURY.exe	116
PID 640 wrote to memory of 652	640	cmd.exe	118
PID 640 wrote to memory of 652	640	cmd.exe	118
PID 640 wrote to memory of 652	640	cmd.exe	118
PID 640 wrote to memory of 3888	640	cmd.exe	119
PID 640 wrote to memory of 3888	640	cmd.exe	119
PID 640 wrote to memory of 3888	640	cmd.exe	119
PID 640 wrote to memory of 1968	640	cmd.exe	121
PID 640 wrote to memory of 1968	640	cmd.exe	121
PID 640 wrote to memory of 1968	640	cmd.exe	121
PID 3396 wrote to memory of 1580	3396	MERCURY.exe	123
PID 3396 wrote to memory of 1580	3396	MERCURY.exe	123
PID 3396 wrote to memory of 1580	3396	MERCURY.exe	123
PID 1580 wrote to memory of 1936	1580	cmd.exe	125
PID 1580 wrote to memory of 1936	1580	cmd.exe	125
PID 1580 wrote to memory of 1936	1580	cmd.exe	125
PID 1580 wrote to memory of 1168	1580	cmd.exe	126
PID 1580 wrote to memory of 1168	1580	cmd.exe	126
PID 1580 wrote to memory of 1168	1580	cmd.exe	126
PID 1580 wrote to memory of 1072	1580	cmd.exe	127
PID 1580 wrote to memory of 1072	1580	cmd.exe	127
PID 1580 wrote to memory of 1072	1580	cmd.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/VS2mj2
1⤵
PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=4144,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:1
1⤵
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --field-trial-handle=4572,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
1⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5428,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
1⤵
PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5444,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
1⤵
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --field-trial-handle=5864,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
1⤵
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5276,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
1⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=5300,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
1⤵
PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=6324,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
1⤵
PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6328,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
1⤵
PID:3504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --field-trial-handle=6176,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
1⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=6784,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
1⤵
PID:1744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=5816,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
1⤵
PID:1936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3872

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\LOGGER\" -spe -an -ai#7zMap28940:74:7zEvent30978
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4132

C:\Users\Admin\Downloads\LOGGER\MERCURY.exe
"C:\Users\Admin\Downloads\LOGGER\MERCURY.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpFF99.tmp.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:652
- - C:\Windows\SysWOW64\taskkill.exe
    TaskKill /F /IM 740
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3888
- - C:\Windows\SysWOW64\timeout.exe
    Timeout /T 2 /Nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=6628,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:8
1⤵
PID:1808

C:\Users\Admin\Downloads\LOGGER\MERCURY.exe
"C:\Users\Admin\Downloads\LOGGER\MERCURY.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp1E4C.tmp.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1936
- - C:\Windows\SysWOW64\taskkill.exe
    TaskKill /F /IM 3396
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- - C:\Windows\SysWOW64\timeout.exe
    Timeout /T 2 /Nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1E4C.tmp.bat

Filesize
57B

MD5
5598d897b4a0bf5b17851502805f03af

SHA1
7049efc5342bc12de09d37d96e93d51377613b68

SHA256
1f25f13f26fc956e6c9a416a7a342ffb350d16d86f80e5bb050f64928d4a5d5a

SHA512
f37c6547d971091d06364a68b3e4459baaaf8864661a46c7fcefa5d89d034a39e5d5731c221853fbc8406b59c6e7e9a11f379c1d34c4be7243f68e066d78cde7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFF99.tmp.bat

Filesize
56B

MD5
1ebf6f8c5adfdb38b5c07f151d29c090

SHA1
9e300f762b31b1c1a5a80e741a2c01d65567c0f6

SHA256
aa6ec0f079473953d873b346b0486327ee754acbfe8bae77edba5fc42abd52c1

SHA512
86b012da0ec12a179af335ac597a83dad19e345eece677d0a027b00e6b7305cdac81e6022a4ca6a9d4e5f6c5592f43f7ffeaedddf222c5550aeb42bca69c4dbd

Download Submit
C:\Users\Admin\Downloads\LOGGER\MERCURY.exe

Filesize
1.6MB

MD5
02c88fe38285c217f895ff539c631fc5

SHA1
b0d560a11ce564c5272e879f321688b97561f55c

SHA256
7b7fb709fbfa417617beda6fdceb611b51f7d4d76881a106c0edf683fd170e36

SHA512
45498d421c5f13af6382a2ee54c7e2a044a25334c4186450426e52b96c21b9fb97b17d6ddb515f47c9fb19ab5dab37e7bef0cfe0f544f9bb5896ea5ea18c667e

Download Submit
C:\Users\Admin\Downloads\LOGGER\msvcp140.dll

Filesize
550KB

MD5
1d9dc2280f84a086c5f7fd309c326bfe

SHA1
74838f2e0d41bc724470769eeaaefb5c0048f58d

SHA256
acfdb6f0bf4748a0f1866e7d9f462a1af65f4c4a2ddf3472a55092ab82c95fea

SHA512
5bc0e74cee435e0218085496935d2c8137db7aaf9922ed282021e6c2fe98d17ab7a383681c41779bede34de58540701c83a60a5eac3a296337ddbb2836b4e289

Download Submit
memory/740-10-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

Filesize
4KB

Download
memory/740-11-0x0000000000100000-0x0000000000296000-memory.dmp

Filesize
1.6MB

Download
memory/740-12-0x0000000004B20000-0x0000000004B86000-memory.dmp

Filesize
408KB

Download
memory/740-13-0x0000000074A10000-0x00000000751C0000-memory.dmp

Filesize
7.7MB

Download
memory/740-16-0x0000000074A10000-0x00000000751C0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing