metastealer | d364d8e6571c30c429dd32746b62b06d60b743f1af3f496a8167e4659c001c6a

General

Target

gate_v2.exe
Size

937KB
MD5

d278e6e06cfc85443305fdeb3613c6b4
SHA1

e7cdf1906a069c08c7bea43a7378fbcd9f52957c
SHA256

d364d8e6571c30c429dd32746b62b06d60b743f1af3f496a8167e4659c001c6a
SHA512

a01260475ec7b5b5da86c7af569385aa65ae9afcb06e11ad1e4ff3c15ec285b530e8a2e290abb50e0d6246a0c4e36fdd27530ea9b7355ba3243c98eff78001a6

Score

10^/10

metastealer stealer

Malware Config

Extracted

Family

metastealer

C2

193.106.191.162:1775

Signatures

Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer
Suspicious use of SetThreadContext 1 IoCs

Processes:

gate_v2.exe

description pid process target process

PID 3080 set thread context of 4672 3080 gate_v2.exe AppLaunch.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

5064 powershell.exe
5088 powershell.exe
5064 powershell.exe
5088 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 5064 powershell.exe
Token: SeDebugPrivilege 5088 powershell.exe

description	pid	process	target process
PID 3080 set thread context of 4672	3080	gate_v2.exe	AppLaunch.exe

pid	process
5064	powershell.exe
5088	powershell.exe
5064	powershell.exe
5088	powershell.exe

description	pid	process
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

gate_v2.exeAppLaunch.exe

description	pid	process	target process
PID 3080 wrote to memory of 4672	3080	gate_v2.exe	AppLaunch.exe
PID 3080 wrote to memory of 4672	3080	gate_v2.exe	AppLaunch.exe
PID 3080 wrote to memory of 4672	3080	gate_v2.exe	AppLaunch.exe
PID 3080 wrote to memory of 4672	3080	gate_v2.exe	AppLaunch.exe
PID 3080 wrote to memory of 4672	3080	gate_v2.exe	AppLaunch.exe
PID 4672 wrote to memory of 5088	4672	AppLaunch.exe	powershell.exe
PID 4672 wrote to memory of 5088	4672	AppLaunch.exe	powershell.exe
PID 4672 wrote to memory of 5088	4672	AppLaunch.exe	powershell.exe
PID 4672 wrote to memory of 5064	4672	AppLaunch.exe	powershell.exe
PID 4672 wrote to memory of 5064	4672	AppLaunch.exe	powershell.exe
PID 4672 wrote to memory of 5064	4672	AppLaunch.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\gate_v2.exe
"C:\Users\Admin\AppData\Local\Temp\gate_v2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension "exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell rename-item -path C:\Users\Admin\AppData\Local\Microsoft\Windows\hyper-v.xyz -newname hyper-v.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
def65711d78669d7f8e69313be4acf2e

SHA1
6522ebf1de09eeb981e270bd95114bc69a49cda6

SHA256
aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

SHA512
05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
9b0dd01ea5fc7ee6f9cc5acc0b9e69ea

SHA1
3d062189831b66ac98ed3ca2b0f20a3dc5d7e470

SHA256
8e2e4323fa8dd55f62ec4ddf4be20985448732836a84beb05be244a938511cee

SHA512
d6a91ed82b69f6fa37e40baf610c3ce1d101dc70d6f55e82f38ca6917a1bb0d9b730bcdc10ba38222fc66b837b2d519c7b99d3d23715d8c1690ca0c2af46fc7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\hyper-v.xyz

Filesize
101KB

MD5
89d41e1cf478a3d3c2c701a27a5692b2

SHA1
691e20583ef80cb9a2fd3258560e7f02481d12fd

SHA256
dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac

SHA512
5c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc

Download Submit
memory/3080-132-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Filesize
384KB

Download
memory/3080-135-0x000000000013C000-0x000000000013E000-memory.dmp

Filesize
8KB

Download
memory/3080-134-0x0000000003640000-0x0000000003643000-memory.dmp

Filesize
12KB

Download
memory/4672-124-0x0000000000000000-mapping.dmp

Download
memory/4672-125-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/4672-133-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/4672-136-0x0000000010000000-0x0000000010196000-memory.dmp

Filesize
1.6MB

Download
memory/5064-149-0x0000000006950000-0x000000000696A000-memory.dmp

Filesize
104KB

Download
memory/5064-154-0x0000000007A40000-0x0000000007FE4000-memory.dmp

Filesize
5.6MB

Download
memory/5064-145-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/5064-146-0x0000000005E30000-0x0000000005E96000-memory.dmp

Filesize
408KB

Download
memory/5064-147-0x0000000006420000-0x000000000643E000-memory.dmp

Filesize
120KB

Download
memory/5064-148-0x00000000073F0000-0x0000000007486000-memory.dmp

Filesize
600KB

Download
memory/5064-143-0x0000000005620000-0x0000000005C48000-memory.dmp

Filesize
6.2MB

Download
memory/5064-150-0x0000000006970000-0x0000000006992000-memory.dmp

Filesize
136KB

Download
memory/5064-141-0x0000000000000000-mapping.dmp

Download
memory/5064-156-0x0000000004FE5000-0x0000000004FE7000-memory.dmp

Filesize
8KB

Download
memory/5064-142-0x0000000002B10000-0x0000000002B46000-memory.dmp

Filesize
216KB

Download
memory/5064-144-0x0000000005490000-0x00000000054B2000-memory.dmp

Filesize
136KB

Download
memory/5088-153-0x0000000006550000-0x000000000656E000-memory.dmp

Filesize
120KB

Download
memory/5088-152-0x00000000703E0000-0x000000007042C000-memory.dmp

Filesize
304KB

Download
memory/5088-157-0x0000000002A35000-0x0000000002A37000-memory.dmp

Filesize
8KB

Download
memory/5088-158-0x0000000007990000-0x000000000800A000-memory.dmp

Filesize
6.5MB

Download
memory/5088-159-0x0000000007350000-0x000000000735A000-memory.dmp

Filesize
40KB

Download
memory/5088-160-0x0000000007500000-0x000000000750E000-memory.dmp

Filesize
56KB

Download
memory/5088-161-0x0000000007600000-0x000000000761A000-memory.dmp

Filesize
104KB

Download
memory/5088-162-0x00000000075F0000-0x00000000075F8000-memory.dmp

Filesize
32KB

Download
memory/5088-151-0x0000000006570000-0x00000000065A2000-memory.dmp

Filesize
200KB

Download
memory/5088-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads