erbium | 2a12326f3bc0714bf663d300d40816af39e9707698056d82f3b5a5046c304566

Analysis

max time kernel
41s
max time network
54s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2A12326F3BC0714BF663D300D40816AF39E9707698056.exe
Size

144KB
MD5

ce9e2ad824abec4012ffe21ea8b2f66d
SHA1

fe617860049990a67b18950660e6276e3c7ee970
SHA256

2a12326f3bc0714bf663d300d40816af39e9707698056d82f3b5a5046c304566
SHA512

fbb16ebdd147f5f7e7937fe1d3bcc506914b7d742245a031d8831739608542df6415807b747aaab95a05cfc58724bec91b1f8720b0c2def5e66d3200cd16c74a
SSDEEP

768:xnnhlLxfF9oifeLc6WDK+w0kabRAUn1vh+vPqVOz7T2QbYtm6uROAhr:nlb9oIKWDK+w0ZbRhn1vh+v/T3Y46uD

Score

10^/10

erbium stealer

Malware Config

Extracted

Family

erbium

77.73.133.53

Signatures

Erbium
Erbium is an infostealer written in C++ and first seen in July 2022.
stealer erbium
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1252 set thread context of 1328	1252	2A12326F3BC0714BF663D300D40816AF39E9707698056.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1328	1252	2A12326F3BC0714BF663D300D40816AF39E9707698056.exe	28
PID 1252 wrote to memory of 1328	1252	2A12326F3BC0714BF663D300D40816AF39E9707698056.exe	28
PID 1252 wrote to memory of 1328	1252	2A12326F3BC0714BF663D300D40816AF39E9707698056.exe	28
PID 1252 wrote to memory of 1328	1252	2A12326F3BC0714BF663D300D40816AF39E9707698056.exe	28
PID 1252 wrote to memory of 1328	1252	2A12326F3BC0714BF663D300D40816AF39E9707698056.exe	28
PID 1252 wrote to memory of 1328	1252	2A12326F3BC0714BF663D300D40816AF39E9707698056.exe	28
PID 1252 wrote to memory of 1328	1252	2A12326F3BC0714BF663D300D40816AF39E9707698056.exe	28
PID 1252 wrote to memory of 1328	1252	2A12326F3BC0714BF663D300D40816AF39E9707698056.exe	28
PID 1252 wrote to memory of 1328	1252	2A12326F3BC0714BF663D300D40816AF39E9707698056.exe	28

C:\Users\Admin\AppData\Local\Temp\2A12326F3BC0714BF663D300D40816AF39E9707698056.exe
"C:\Users\Admin\AppData\Local\Temp\2A12326F3BC0714BF663D300D40816AF39E9707698056.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1252-54-0x0000000000360000-0x000000000038A000-memory.dmp

Filesize
168KB

Download
memory/1252-55-0x0000000075611000-0x0000000075613000-memory.dmp

Filesize
8KB

Download
memory/1328-56-0x0000000000080000-0x0000000000085000-memory.dmp

Filesize
20KB

Download
memory/1328-57-0x0000000000080000-0x0000000000085000-memory.dmp

Filesize
20KB

Download
memory/1328-58-0x0000000000080000-0x0000000000085000-memory.dmp

Filesize
20KB

Download
memory/1328-59-0x0000000000080000-0x0000000000085000-memory.dmp

Filesize
20KB

Download
memory/1328-62-0x0000000000080000-0x0000000000085000-memory.dmp

Filesize
20KB

Download
memory/1328-65-0x0000000000080000-0x0000000000085000-memory.dmp

Filesize
20KB

Download
memory/1328-68-0x0000000000080000-0x0000000000085000-memory.dmp

Filesize
20KB

Download