stealerium | a9c4a4b40d757cdba423f57494d97e10f9945798bd0fcd42c29e1ff5d75e2673

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23/02/2025, 03:03 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9c4a4b40d757cdba423f57494d97e10f9945798bd0fcd42c29e1ff5d75e2673.exe
Size

2.5MB
MD5

daf2f1918c4fc0bc4f62d3ef2ca5fcf5
SHA1

86c58982e79bed1d54e52723ff093ee0854097de
SHA256

a9c4a4b40d757cdba423f57494d97e10f9945798bd0fcd42c29e1ff5d75e2673
SHA512

1671cb41575e3899512ec58541d316dad49bcdd4390a17f75bd4e463e35395d32c99d0a13243862f190eb688966fd867e0cb41c9edc0987436c166afecfb7d36
SSDEEP

24576:ZRIHBzId3Kduyws2Mp74sa9mZBymHCWkxkTl9TNdsMEubODA46bnuxFJoFUBr0Kh:Zehz43hnod4V9onkyQVFOKo

Score

10^/10

stealerium discovery stealer

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/1253109934091014266/Dmdrv6qHpmv5oToIz1KdEPpQ1-xVWgQVY5fKv-5qy8MbZxkTw_uQb7UG4GOEd8HAYN7f

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Stealerium family
stealerium

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2540	2408	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9c4a4b40d757cdba423f57494d97e10f9945798bd0fcd42c29e1ff5d75e2673.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2540	2408	a9c4a4b40d757cdba423f57494d97e10f9945798bd0fcd42c29e1ff5d75e2673.exe	30
PID 2408 wrote to memory of 2540	2408	a9c4a4b40d757cdba423f57494d97e10f9945798bd0fcd42c29e1ff5d75e2673.exe	30
PID 2408 wrote to memory of 2540	2408	a9c4a4b40d757cdba423f57494d97e10f9945798bd0fcd42c29e1ff5d75e2673.exe	30
PID 2408 wrote to memory of 2540	2408	a9c4a4b40d757cdba423f57494d97e10f9945798bd0fcd42c29e1ff5d75e2673.exe	30

C:\Users\Admin\AppData\Local\Temp\a9c4a4b40d757cdba423f57494d97e10f9945798bd0fcd42c29e1ff5d75e2673.exe
"C:\Users\Admin\AppData\Local\Temp\a9c4a4b40d757cdba423f57494d97e10f9945798bd0fcd42c29e1ff5d75e2673.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 644
  2⤵
  - Program crash
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2408-0-0x000000007411E000-0x000000007411F000-memory.dmp

Filesize
4KB

Download
memory/2408-1-0x0000000000B10000-0x0000000000D9C000-memory.dmp

Filesize
2.5MB

Download
memory/2408-2-0x000000000BD10000-0x000000000BEA6000-memory.dmp

Filesize
1.6MB

Download
memory/2408-3-0x0000000004BC0000-0x0000000004D52000-memory.dmp

Filesize
1.6MB

Download