Analysis
- max time kernel
31s - max time network
42s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
13/10/2022, 16:27
General
- Target CHEESE.exe
- Size 2.4MB
- Sample221013-tx24csdcb6
- SHA256 2180293a0c0b7340f85543d453c10e8f9a059b69a530428fe1858e92a7fa63c3
Malware Config
Extracted
-
erbium
-
http://77.73.133.53/cloud/index.php
Signatures
- Erbium
Erbium is an infostealer written in C++ and first seen in July 2022.
- Downloads MZ/PE file
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CHEESE.exe"C:\Users\Admin\AppData\Local\Temp\CHEESE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/98660-54-0x0000000000400000-0x0000000000405000-memory.dmp
memory/98660-56-0x0000000000400000-0x0000000000405000-memory.dmp
memory/98660-63-0x0000000000400000-0x0000000000405000-memory.dmp
memory/98660-64-0x0000000006B90000-0x0000000006E54000-memory.dmp
memory/98660-66-0x0000000006B90000-0x0000000006E54000-memory.dmp
memory/98660-68-0x0000000006B90000-0x0000000006E54000-memory.dmp
memory/98660-70-0x0000000006B90000-0x0000000006E54000-memory.dmp
memory/98660-72-0x0000000006B90000-0x0000000006E54000-memory.dmp
memory/98660-73-0x0000000006B90000-0x0000000006E54000-memory.dmp
memory/98660-75-0x0000000075BD1000-0x0000000075BD3000-memory.dmp
memory/98660-76-0x0000000006B90000-0x0000000006E54000-memory.dmp
memory/98660-77-0x0000000006B90000-0x0000000006E54000-memory.dmp