erbium | 320768f639fab3b6d3832c460fabb34f6938156af39421d94ce1bc9037bd0757

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2022, 06:52

Target
MetaLauncher.exe
Size 2.5MB
Sample221017-hm3rcsahe9
SHA256 320768f639fab3b6d3832c460fabb34f6938156af39421d94ce1bc9037bd0757
MD5 adb6a392e4b6ca068c380bdac98b2522
SHA1 b6e1318fbeba0e0deb7e31f4041fb4dd72e83701
SHA512 ea82b34649beeceab7d637bd7f49a0ee8ade5d45a283233f1f6260cc163e8dc88d29f481def496be387a805309f83b37ba5a6e7f46eaa5cfa3fcc931f9b5ccd5
SSDEEP 24576:y+JbPh21BFO9OVVCsjYyYpwykl36WMCMdXBN4ZO7T1qhfHeHLMlhvMTTw5l3RuQj:Jxpqe9sVCSQjBqhfHeHYlhG05l3D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

erbium stealer

Family

Erbium
Erbium is an infostealer written in C++ and first seen in July 2022.
stealer erbium
Downloads MZ/PE file

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5092 set thread context of 100192	5092	MetaLauncher.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
100192	AppLaunch.exe
100192	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 100192	5092	MetaLauncher.exe	82
PID 5092 wrote to memory of 100192	5092	MetaLauncher.exe	82
PID 5092 wrote to memory of 100192	5092	MetaLauncher.exe	82
PID 5092 wrote to memory of 100192	5092	MetaLauncher.exe	82
PID 5092 wrote to memory of 100192	5092	MetaLauncher.exe	82

C:\Users\Admin\AppData\Local\Temp\MetaLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\MetaLauncher.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:100192

memory/100192-133-0x0000000000600000-0x0000000000605000-memory.dmp

Download

memory/100192-139-0x0000000000600000-0x0000000000605000-memory.dmp

Download

memory/100192-140-0x0000000006890000-0x0000000006B53000-memory.dmp

Download

memory/100192-141-0x0000000006890000-0x0000000006B53000-memory.dmp

Download

memory/100192-142-0x0000000006890000-0x0000000006B53000-memory.dmp

Download