stealerium | f06316c624961051e89bfa9d6a2cd647e2749006eb2a867cac1976667055f3b4

General

Target

f06316c624961051e89bfa9d6a2cd647e2749006eb2a867cac1976667055f3b4.exe
Size

1.6MB
MD5

be830082457d9fc658309f95a07099da
SHA1

8fcc5988cb62925e26c5f3567223fff79efa351e
SHA256

f06316c624961051e89bfa9d6a2cd647e2749006eb2a867cac1976667055f3b4
SHA512

af6d0264d77674fab722e6d0d268027a6053d942acfc9a8f3b94f4230842761411c081c9a78cc9c58865a4bc4d14680e963468db8d9a0ef69846cf4e9b87b430
SSDEEP

24576:Yi2Q9NXw2/wPOjdGxY2rJxkqjVnlqud+/2P+A+ZecdyFoBkkAqmZywm0n:HTq24GjdGSiJxkqXfd+/9AqYanCLm

Score

10^/10

stealerium discovery stealer

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1288466233993334785/bvXUkJru6bM4LZMznPzmSqzB7BV8e49Q0i4gDuNVtyNDqrIuEAvj0zzmaOdSBD0yMLcb

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	discord.com
5	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f06316c624961051e89bfa9d6a2cd647e2749006eb2a867cac1976667055f3b4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2784	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2768	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	f06316c624961051e89bfa9d6a2cd647e2749006eb2a867cac1976667055f3b4.exe
Token: SeDebugPrivilege	2768	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2224	1732	f06316c624961051e89bfa9d6a2cd647e2749006eb2a867cac1976667055f3b4.exe	32
PID 1732 wrote to memory of 2224	1732	f06316c624961051e89bfa9d6a2cd647e2749006eb2a867cac1976667055f3b4.exe	32
PID 1732 wrote to memory of 2224	1732	f06316c624961051e89bfa9d6a2cd647e2749006eb2a867cac1976667055f3b4.exe	32
PID 1732 wrote to memory of 2224	1732	f06316c624961051e89bfa9d6a2cd647e2749006eb2a867cac1976667055f3b4.exe	32
PID 2224 wrote to memory of 2800	2224	cmd.exe	34
PID 2224 wrote to memory of 2800	2224	cmd.exe	34
PID 2224 wrote to memory of 2800	2224	cmd.exe	34
PID 2224 wrote to memory of 2800	2224	cmd.exe	34
PID 2224 wrote to memory of 2768	2224	cmd.exe	35
PID 2224 wrote to memory of 2768	2224	cmd.exe	35
PID 2224 wrote to memory of 2768	2224	cmd.exe	35
PID 2224 wrote to memory of 2768	2224	cmd.exe	35
PID 2224 wrote to memory of 2784	2224	cmd.exe	36
PID 2224 wrote to memory of 2784	2224	cmd.exe	36
PID 2224 wrote to memory of 2784	2224	cmd.exe	36
PID 2224 wrote to memory of 2784	2224	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\f06316c624961051e89bfa9d6a2cd647e2749006eb2a867cac1976667055f3b4.exe
"C:\Users\Admin\AppData\Local\Temp\f06316c624961051e89bfa9d6a2cd647e2749006eb2a867cac1976667055f3b4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpF45D.tmp.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2800
- - C:\Windows\SysWOW64\taskkill.exe
    TaskKill /F /IM 1732
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- - C:\Windows\SysWOW64\timeout.exe
    Timeout /T 2 /Nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF45D.tmp.bat

Filesize
57B

MD5
833be36e2b3fcdf32573452ac465456b

SHA1
be2241cc9f6f879aa7ecf6ee968b9897a1265c43

SHA256
f41bc09ba67841df902c8003f5d868758247b814d5e26aa36835a61c396cfe9d

SHA512
d13cc613adb09b403c7e5d4e53ade201c2042825459674c27a96a169d02458940504d8418363962ad682128b948fdd87b4d96cf98786ae9836998480f66d87d1

Download Submit
memory/1732-0-0x00000000740FE000-0x00000000740FF000-memory.dmp

Filesize
4KB

Download
memory/1732-1-0x0000000000FC0000-0x0000000001156000-memory.dmp

Filesize
1.6MB

Download
memory/1732-2-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/1732-3-0x00000000740FE000-0x00000000740FF000-memory.dmp

Filesize
4KB

Download
memory/1732-4-0x0000000005890000-0x0000000005930000-memory.dmp

Filesize
640KB

Download
memory/1732-5-0x00000000004E0000-0x0000000000506000-memory.dmp

Filesize
152KB

Download
memory/1732-6-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/1732-9-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing