Analysis
-
max time kernel
449s -
max time network
1172s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-de -
resource tags
arch:x64arch:x86image:win10v2004-20240611-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
30-06-2024 17:04
Behavioral task
behavioral1
Sample
reload-beta.exe
Resource
win10v2004-20240611-de
General
-
Target
reload-beta.exe
-
Size
1.6MB
-
MD5
281d200e4d94f020e9945e3812aec967
-
SHA1
7738475daded508bd105bd296d1f47ae05febe68
-
SHA256
15973284c2f6be38e8ab31e01d3d0a59d87ff03c98126754a61283265cd769e3
-
SHA512
600e54b853cbf68f3862728d80f0ff1ad835b6baa6dbe57e2e28e81a90d4026ee56a7b395f322b353dde018369084bc45fb470fd550d231f06b39522c75aa9b0
-
SSDEEP
49152:hkTq24GjdGSiqkqXfd+/9AqYanieKdsX:h1EjdGSiqkqXf0FLYW
Malware Config
Extracted
stealerium
https://discord.com/api/webhooks/1257008132761194659/j4YbzwxG41tBMUV2ew7ukKuFT4XUWR1j2htz3bWYzHr9A_UbewGf2LUD0JL44NpvUur-
Signatures
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
reload-beta.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 reload-beta.exe Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 reload-beta.exe Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 reload-beta.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 20 icanhazip.com -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exenetsh.exenetsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4364 3480 WerFault.exe reload-beta.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
reload-beta.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 reload-beta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier reload-beta.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
reload-beta.exepid process 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe 3480 reload-beta.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
reload-beta.exemsiexec.exedescription pid process Token: SeDebugPrivilege 3480 reload-beta.exe Token: SeSecurityPrivilege 3228 msiexec.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
reload-beta.execmd.execmd.execmd.exedescription pid process target process PID 3480 wrote to memory of 4380 3480 reload-beta.exe cmd.exe PID 3480 wrote to memory of 4380 3480 reload-beta.exe cmd.exe PID 3480 wrote to memory of 4380 3480 reload-beta.exe cmd.exe PID 4380 wrote to memory of 1136 4380 cmd.exe chcp.com PID 4380 wrote to memory of 1136 4380 cmd.exe chcp.com PID 4380 wrote to memory of 1136 4380 cmd.exe chcp.com PID 4380 wrote to memory of 4580 4380 cmd.exe netsh.exe PID 4380 wrote to memory of 4580 4380 cmd.exe netsh.exe PID 4380 wrote to memory of 4580 4380 cmd.exe netsh.exe PID 4380 wrote to memory of 3124 4380 cmd.exe findstr.exe PID 4380 wrote to memory of 3124 4380 cmd.exe findstr.exe PID 4380 wrote to memory of 3124 4380 cmd.exe findstr.exe PID 3480 wrote to memory of 432 3480 reload-beta.exe cmd.exe PID 3480 wrote to memory of 432 3480 reload-beta.exe cmd.exe PID 3480 wrote to memory of 432 3480 reload-beta.exe cmd.exe PID 432 wrote to memory of 4968 432 cmd.exe chcp.com PID 432 wrote to memory of 4968 432 cmd.exe chcp.com PID 432 wrote to memory of 4968 432 cmd.exe chcp.com PID 432 wrote to memory of 2120 432 cmd.exe netsh.exe PID 432 wrote to memory of 2120 432 cmd.exe netsh.exe PID 432 wrote to memory of 2120 432 cmd.exe netsh.exe PID 432 wrote to memory of 676 432 cmd.exe findstr.exe PID 432 wrote to memory of 676 432 cmd.exe findstr.exe PID 432 wrote to memory of 676 432 cmd.exe findstr.exe PID 3480 wrote to memory of 1680 3480 reload-beta.exe cmd.exe PID 3480 wrote to memory of 1680 3480 reload-beta.exe cmd.exe PID 3480 wrote to memory of 1680 3480 reload-beta.exe cmd.exe PID 1680 wrote to memory of 2592 1680 cmd.exe chcp.com PID 1680 wrote to memory of 2592 1680 cmd.exe chcp.com PID 1680 wrote to memory of 2592 1680 cmd.exe chcp.com PID 1680 wrote to memory of 4660 1680 cmd.exe netsh.exe PID 1680 wrote to memory of 4660 1680 cmd.exe netsh.exe PID 1680 wrote to memory of 4660 1680 cmd.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
reload-beta.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 reload-beta.exe -
outlook_win_path 1 IoCs
Processes:
reload-beta.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 reload-beta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\reload-beta.exe"C:\Users\Admin\AppData\Local\Temp\reload-beta.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001." key=clear | findstr Key2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile name="65001." key=clear3⤵
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\findstr.exefindstr Key3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 29002⤵
- Program crash
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3480 -ip 34801⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\58fa70275e675611d412de64b8d71464\Admin@EJEFCDNK_de-DE\Browsers\Firefox\Bookmarks.txtFilesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Local\58fa70275e675611d412de64b8d71464\Admin@EJEFCDNK_de-DE\Directories\OneDrive.txtFilesize
25B
MD5966247eb3ee749e21597d73c4176bd52
SHA11e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA2568ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
SHA512bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
-
C:\Users\Admin\AppData\Local\58fa70275e675611d412de64b8d71464\Admin@EJEFCDNK_de-DE\Directories\Startup.txtFilesize
24B
MD568c93da4981d591704cea7b71cebfb97
SHA1fd0f8d97463cd33892cc828b4ad04e03fc014fa6
SHA256889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
SHA51263455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
-
C:\Users\Admin\AppData\Local\58fa70275e675611d412de64b8d71464\Admin@EJEFCDNK_de-DE\Directories\Videos.txtFilesize
23B
MD51fddbf1169b6c75898b86e7e24bc7c1f
SHA1d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA256a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
SHA51220bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
-
C:\Users\Admin\AppData\Local\58fa70275e675611d412de64b8d71464\Admin@EJEFCDNK_de-DE\System\Apps.txtFilesize
6KB
MD5756673bc40a61887d63ceb4f5ffee5e3
SHA17da974250c7b9432c4e937e56b7630925262467e
SHA256b8a21924e537215dfaf263332df212be34588504fa554d85c2f84e73f111c282
SHA51215e14bd353f9d21e6b86850d8de722f17c2acb43b851c302d9f12384b97398b7125eb764491906622f1ecb2481909160ab070821703fcde0ff8a05168fcebafc
-
C:\Users\Admin\AppData\Local\58fa70275e675611d412de64b8d71464\Admin@EJEFCDNK_de-DE\System\Process.txtFilesize
4KB
MD57e430bed7d546b4a8c9fd02653551436
SHA1654d21788f5cca1ca950da7da477f0124050a3a7
SHA256a6600c18a420683ea7b4e285a8f6b79f6172870d8572c975386d4ee30251554e
SHA512de662808cf86eb2ebdbd08aa06813de4ed39e794b9d4541346b235633c56715a6c300dd3c8c3382cb8ceee2065ca30e5ed9043b6e322f4c552f24f35430f5719
-
C:\Users\Admin\AppData\Local\58fa70275e675611d412de64b8d71464\Admin@EJEFCDNK_de-DE\System\ProductKey.txtFilesize
29B
MD571eb5479298c7afc6d126fa04d2a9bde
SHA1a9b3d5505cf9f84bb6c2be2acece53cb40075113
SHA256f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
SHA5127c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd
-
C:\Users\Admin\AppData\Local\Temp\Stealerium-Latest.logFilesize
1KB
MD5c3e8190d09118f54b0194319eff64895
SHA1d1f2c9ace1090b5c696f36f6be7a4325822fd2a2
SHA2564870be1315c03cd108c8cbf58a35276df4af81705ef5b50220497787e19a7434
SHA5127e55356d32cd32ce814ed24982d63d9088d3691449fb6e9d0e840eae490ed4364fafaebc958ea8df64d251bf17255c42fbe569127acfd4cdf0c345c8be7a44dd
-
memory/3480-7-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/3480-9-0x0000000005A30000-0x0000000005A38000-memory.dmpFilesize
32KB
-
memory/3480-12-0x0000000006C10000-0x0000000006C2E000-memory.dmpFilesize
120KB
-
memory/3480-13-0x0000000006C90000-0x0000000006CD2000-memory.dmpFilesize
264KB
-
memory/3480-14-0x0000000006DF0000-0x0000000006EF4000-memory.dmpFilesize
1.0MB
-
memory/3480-10-0x0000000005A40000-0x0000000005A4A000-memory.dmpFilesize
40KB
-
memory/3480-72-0x0000000007270000-0x0000000007302000-memory.dmpFilesize
584KB
-
memory/3480-0-0x000000007539E000-0x000000007539F000-memory.dmpFilesize
4KB
-
memory/3480-77-0x0000000007C40000-0x00000000081E4000-memory.dmpFilesize
5.6MB
-
memory/3480-11-0x0000000006C00000-0x0000000006C08000-memory.dmpFilesize
32KB
-
memory/3480-8-0x0000000005D80000-0x0000000005DA6000-memory.dmpFilesize
152KB
-
memory/3480-204-0x0000000006FC0000-0x000000000703A000-memory.dmpFilesize
488KB
-
memory/3480-6-0x0000000005A50000-0x0000000005A6C000-memory.dmpFilesize
112KB
-
memory/3480-3-0x0000000075390000-0x0000000075B40000-memory.dmpFilesize
7.7MB
-
memory/3480-2-0x0000000005650000-0x00000000056B6000-memory.dmpFilesize
408KB
-
memory/3480-1-0x0000000000C30000-0x0000000000DC2000-memory.dmpFilesize
1.6MB
-
memory/3480-285-0x0000000007310000-0x00000000073C2000-memory.dmpFilesize
712KB
-
memory/3480-287-0x0000000006F20000-0x0000000006F42000-memory.dmpFilesize
136KB
-
memory/3480-288-0x00000000083F0000-0x0000000008744000-memory.dmpFilesize
3.3MB
-
memory/3480-289-0x0000000075390000-0x0000000075B40000-memory.dmpFilesize
7.7MB