metastealer | 2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8

General

Target

2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8.exe
Size

2.2MB
MD5

41d2d84306230b4b34fd9bba81c8c266
SHA1

b50404acbac5c7d8315fecd477a1d43ddf6e812e
SHA256

2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8
SHA512

0431136940780b6e9e4565c39e78a66b9c3a677dbd8cb0aad2b29c995c11001916931d402c332d480d4806463fa51c3ae3478a17f7724c7663374455c9221bc8

Score

10^/10

Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/1436-141-0x0000000000B00000-0x0000000000BE8000-memory.dmp	autoit_exe
behavioral2/memory/1436-145-0x0000000000B00000-0x0000000000BE8000-memory.dmp	autoit_exe
behavioral2/memory/1436-149-0x0000000000B00000-0x0000000000BE8000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 924 set thread context of 1436	924	2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8.exe	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1436	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
924	2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	924	2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 1436	924	2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8.exe	79
PID 924 wrote to memory of 1436	924	2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8.exe	79
PID 924 wrote to memory of 1436	924	2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8.exe	79
PID 924 wrote to memory of 1436	924	2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8.exe	79
PID 924 wrote to memory of 1436	924	2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8.exe	79
PID 924 wrote to memory of 1436	924	2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8.exe	79
PID 924 wrote to memory of 1436	924	2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8.exe	79
PID 924 wrote to memory of 1436	924	2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8.exe	79
PID 924 wrote to memory of 1436	924	2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8.exe	79
PID 924 wrote to memory of 1436	924	2b9874c1a387cdd9bad50e5ecbb121bc5ac57afc1fcc5e830549641690f93aa8.exe	79

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1436 -ip 1436
1⤵
PID:1896

memory/924-130-0x0000000000040000-0x000000000025A000-memory.dmp

Filesize
2.1MB

Download
memory/924-131-0x0000000004BC0000-0x0000000004C5C000-memory.dmp

Filesize
624KB

Download
memory/924-132-0x00000000079C0000-0x0000000007F64000-memory.dmp

Filesize
5.6MB

Download
memory/924-133-0x0000000007500000-0x0000000007592000-memory.dmp

Filesize
584KB

Download
memory/924-134-0x00000000076A0000-0x0000000007706000-memory.dmp

Filesize
408KB

Download
memory/924-135-0x0000000008FC0000-0x0000000009182000-memory.dmp

Filesize
1.8MB

Download
memory/924-136-0x00000000096C0000-0x0000000009BEC000-memory.dmp

Filesize
5.2MB

Download
memory/924-137-0x0000000008F30000-0x0000000008F52000-memory.dmp

Filesize
136KB

Download
memory/924-138-0x0000000006070000-0x0000000006092000-memory.dmp

Filesize
136KB

Download
memory/1436-141-0x0000000000B00000-0x0000000000BE8000-memory.dmp

Filesize
928KB

Download
memory/1436-145-0x0000000000B00000-0x0000000000BE8000-memory.dmp

Filesize
928KB

Download
memory/1436-149-0x0000000000B00000-0x0000000000BE8000-memory.dmp

Filesize
928KB

Download