metastealer | 0040225cba2bdf8ada83f22d426316c0c7e5c3c79b55710f993afe2c3202003f

General

Target

0040225cba2bdf8ada83f22d426316c0c7e5c3c79b55710f993afe2c3202003f.exe
Size

367KB
MD5

01f9c5c62b69dfbc7a527f5c9d7cd631
SHA1

2bac0647e62a496b018ba9debfcb3281b6a89044
SHA256

0040225cba2bdf8ada83f22d426316c0c7e5c3c79b55710f993afe2c3202003f
SHA512

cf0707d0dee549eb556dada33b13d3d8a5786e18525111505c9015422fe598d019237cdd86e3328f14d273cd735767e35eb2c09c26863291e90bb95f1bae0486

Score

10^/10

metastealer discovery spyware stealer

Malware Config

Signatures

Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
260	3392	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3392	0040225cba2bdf8ada83f22d426316c0c7e5c3c79b55710f993afe2c3202003f.exe
3392	0040225cba2bdf8ada83f22d426316c0c7e5c3c79b55710f993afe2c3202003f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	0040225cba2bdf8ada83f22d426316c0c7e5c3c79b55710f993afe2c3202003f.exe

C:\Users\Admin\AppData\Local\Temp\0040225cba2bdf8ada83f22d426316c0c7e5c3c79b55710f993afe2c3202003f.exe
"C:\Users\Admin\AppData\Local\Temp\0040225cba2bdf8ada83f22d426316c0c7e5c3c79b55710f993afe2c3202003f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 1340
  2⤵
  - Program crash
  PID:260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3392 -ip 3392
1⤵
PID:3512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3392-124-0x00000000007B2000-0x00000000007DC000-memory.dmp

Filesize
168KB

Download
memory/3392-125-0x00000000007B2000-0x00000000007DC000-memory.dmp

Filesize
168KB

Download
memory/3392-126-0x0000000000710000-0x0000000000747000-memory.dmp

Filesize
220KB

Download
memory/3392-127-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3392-128-0x0000000004B90000-0x0000000005134000-memory.dmp

Filesize
5.6MB

Download
memory/3392-129-0x0000000005170000-0x0000000005788000-memory.dmp

Filesize
6.1MB

Download
memory/3392-130-0x0000000005820000-0x0000000005832000-memory.dmp

Filesize
72KB

Download
memory/3392-131-0x0000000005840000-0x000000000594A000-memory.dmp

Filesize
1.0MB

Download
memory/3392-132-0x0000000005990000-0x00000000059CC000-memory.dmp

Filesize
240KB

Download
memory/3392-133-0x0000000004B84000-0x0000000004B86000-memory.dmp

Filesize
8KB

Download
memory/3392-134-0x0000000005C70000-0x0000000005D02000-memory.dmp

Filesize
584KB

Download
memory/3392-135-0x0000000005D10000-0x0000000005D86000-memory.dmp

Filesize
472KB

Download
memory/3392-136-0x0000000005F40000-0x0000000005F5E000-memory.dmp

Filesize
120KB

Download
memory/3392-137-0x0000000005F90000-0x0000000005FF6000-memory.dmp

Filesize
408KB

Download
memory/3392-138-0x00000000081C0000-0x0000000008382000-memory.dmp

Filesize
1.8MB

Download
memory/3392-139-0x0000000008650000-0x0000000008B7C000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing