stealerium | 806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551.exe
Size

3.8MB
MD5

1c25367e4c2492ebf34728546f96789e
SHA1

7ee66552ce8fab8f137e1e67dcd6f79355d78b1e
SHA256

806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551
SHA512

7f20b8df12f0bee55eda4d1a8ba00a234ebfb37aff83e7b4ab38186c3947f696f5ccf643d03d9e8103b2880b5f190fb465df4b099d37d6385d66dae81baec945
SSDEEP

98304:3PbP5nCK3zBS0g4BchdDh9QWAomJbbbayyxFRPAB:3PbdvB+KkhMxJe/FlAB

Score

10^/10

stealerium discovery stealer

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/1287529665392807997/bGooHy1iKKCIBP7y-Dpt2JaN2ByNuNEr1f3jVU-J6FjhvK_4shc2bdf_Yp-aH-WmAzbF

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	stub.exe

Executes dropped EXE 2 IoCs

pid	Process
2852	stub.exe
4604	build.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
25	discord.com
26	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4784	timeout.exe
4892	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4160	taskkill.exe
4052	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4484	806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551.exe
4484	806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4604	build.exe
Token: SeDebugPrivilege	2852	stub.exe
Token: SeDebugPrivilege	4160	taskkill.exe
Token: SeDebugPrivilege	4052	taskkill.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 2852	4484	806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551.exe	89
PID 4484 wrote to memory of 2852	4484	806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551.exe	89
PID 4484 wrote to memory of 2852	4484	806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551.exe	89
PID 4484 wrote to memory of 4604	4484	806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551.exe	90
PID 4484 wrote to memory of 4604	4484	806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551.exe	90
PID 4484 wrote to memory of 4604	4484	806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551.exe	90
PID 2852 wrote to memory of 4408	2852	stub.exe	94
PID 2852 wrote to memory of 4408	2852	stub.exe	94
PID 2852 wrote to memory of 4408	2852	stub.exe	94
PID 4408 wrote to memory of 4764	4408	cmd.exe	96
PID 4408 wrote to memory of 4764	4408	cmd.exe	96
PID 4408 wrote to memory of 4764	4408	cmd.exe	96
PID 4408 wrote to memory of 4160	4408	cmd.exe	97
PID 4408 wrote to memory of 4160	4408	cmd.exe	97
PID 4408 wrote to memory of 4160	4408	cmd.exe	97
PID 4408 wrote to memory of 4892	4408	cmd.exe	98
PID 4408 wrote to memory of 4892	4408	cmd.exe	98
PID 4408 wrote to memory of 4892	4408	cmd.exe	98
PID 4604 wrote to memory of 988	4604	build.exe	103
PID 4604 wrote to memory of 988	4604	build.exe	103
PID 4604 wrote to memory of 988	4604	build.exe	103
PID 988 wrote to memory of 2056	988	cmd.exe	105
PID 988 wrote to memory of 2056	988	cmd.exe	105
PID 988 wrote to memory of 2056	988	cmd.exe	105
PID 988 wrote to memory of 4052	988	cmd.exe	106
PID 988 wrote to memory of 4052	988	cmd.exe	106
PID 988 wrote to memory of 4052	988	cmd.exe	106
PID 988 wrote to memory of 4784	988	cmd.exe	107
PID 988 wrote to memory of 4784	988	cmd.exe	107
PID 988 wrote to memory of 4784	988	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551.exe
"C:\Users\Admin\AppData\Local\Temp\806b5f2d3b422d192f787a6eb96d0614c943fafb2c2ea53d4917ad123ddf2551.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Temp\stub.exe
  "C:\Users\Admin\AppData\Local\Temp\stub.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpA75.tmp.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:4764
  - - C:\Windows\SysWOW64\taskkill.exe
      TaskKill /F /IM 2852
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4160
  - - C:\Windows\SysWOW64\timeout.exe
      Timeout /T 2 /Nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4892
- C:\Users\Admin\AppData\Local\Temp\build.exe
  "C:\Users\Admin\AppData\Local\Temp\build.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp33F6.tmp.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:2056
  - - C:\Windows\SysWOW64\taskkill.exe
      TaskKill /F /IM 4604
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4052
  - - C:\Windows\SysWOW64\timeout.exe
      Timeout /T 2 /Nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
1⤵
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\build.exe

Filesize
1.6MB

MD5
b6fd03abe0ca99462df8a8dbba293c39

SHA1
58b0fafd5ba58ca4bf0a5666f381bbf4b603120a

SHA256
be3744f29ccf98ec1118ce7492a63178abeeb3e52d0fa28f59e6b3217fdfcc6d

SHA512
f0bce4aa6efbf3be57fad71275824ed339bdcf7e8e0b928f114c92aad0d735c490730f4fc2f54ab088afc25feee203929524445f836f156ff3075134f51a43c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\stub.exe

Filesize
1.6MB

MD5
02c88fe38285c217f895ff539c631fc5

SHA1
b0d560a11ce564c5272e879f321688b97561f55c

SHA256
7b7fb709fbfa417617beda6fdceb611b51f7d4d76881a106c0edf683fd170e36

SHA512
45498d421c5f13af6382a2ee54c7e2a044a25334c4186450426e52b96c21b9fb97b17d6ddb515f47c9fb19ab5dab37e7bef0cfe0f544f9bb5896ea5ea18c667e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp33F6.tmp.bat

Filesize
57B

MD5
da92880b218fa6852199b9893290f982

SHA1
59c2dcccbee0624647799eeff0a17449b708f251

SHA256
88825153c03c6ecfe6f9765e56fbdb6c16ca10714eecd85c18805f8e611c6e43

SHA512
b8542a571d0142a85e03aba6537da4c5a7ce5f1d1f2d2a28bf65d16b25b1c436db133eb9483f6cfb2b4896324825041045653ed0d85db8ddf26deb5a29d0f72d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA75.tmp.bat

Filesize
57B

MD5
04195a90284b9e7205e9f77407c50ead

SHA1
865bbb3df3722396f63bb9b367fda0d3f6e74f39

SHA256
f5e4c0a1df31606f25c6f594318c1527815eaa9b3c708f2a68bf1f99eba4cef9

SHA512
5b02678ff68f0a982a55edd5f3d1a9abebf49e88698b12603f1e77120a6b5c6666bbecc39f73fa6555fbaf950620b6dca2d41431c9a629597b6d3d7bbb09d5a3

Download Submit
memory/2852-47-0x0000000073490000-0x0000000073C40000-memory.dmp

Filesize
7.7MB

Download
memory/2852-40-0x0000000073490000-0x0000000073C40000-memory.dmp

Filesize
7.7MB

Download
memory/2852-38-0x0000000000160000-0x00000000002F6000-memory.dmp

Filesize
1.6MB

Download
memory/2852-36-0x0000000073490000-0x0000000073C40000-memory.dmp

Filesize
7.7MB

Download
memory/4484-34-0x0000000000400000-0x0000000000C5D000-memory.dmp

Filesize
8.4MB

Download
memory/4484-9-0x0000000000400000-0x0000000000C5D000-memory.dmp

Filesize
8.4MB

Download
memory/4484-2-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/4484-28-0x0000000000400000-0x0000000000C5D000-memory.dmp

Filesize
8.4MB

Download
memory/4484-4-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/4484-33-0x0000000000408000-0x0000000000884000-memory.dmp

Filesize
4.5MB

Download
memory/4484-0-0x0000000000408000-0x0000000000884000-memory.dmp

Filesize
4.5MB

Download
memory/4484-3-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/4484-5-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/4484-6-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/4484-8-0x0000000000400000-0x0000000000C5D000-memory.dmp

Filesize
8.4MB

Download
memory/4484-1-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download
memory/4484-7-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/4604-39-0x0000000005930000-0x0000000005996000-memory.dmp

Filesize
408KB

Download
memory/4604-41-0x0000000073490000-0x0000000073C40000-memory.dmp

Filesize
7.7MB

Download
memory/4604-37-0x0000000000F50000-0x00000000010E6000-memory.dmp

Filesize
1.6MB

Download
memory/4604-48-0x000000007349E000-0x000000007349F000-memory.dmp

Filesize
4KB

Download
memory/4604-49-0x0000000073490000-0x0000000073C40000-memory.dmp

Filesize
7.7MB

Download
memory/4604-50-0x0000000005DD0000-0x0000000005E70000-memory.dmp

Filesize
640KB

Download
memory/4604-51-0x0000000005E70000-0x0000000005E96000-memory.dmp

Filesize
152KB

Download
memory/4604-35-0x000000007349E000-0x000000007349F000-memory.dmp

Filesize
4KB

Download
memory/4604-56-0x0000000073490000-0x0000000073C40000-memory.dmp

Filesize
7.7MB

Download