a310logger | 87cbfe861d6e50113ce1cd056bb80d521af49e8845177befaa8dc1bb43926480

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15-10-2023 19:44

Target

bc51d3bdc58bb7adb125867d39349390_exe32.exe
Size

93KB
MD5

bc51d3bdc58bb7adb125867d39349390
SHA1

0a3194cecd8a669984265d32d6db468674d9d748
SHA256

87cbfe861d6e50113ce1cd056bb80d521af49e8845177befaa8dc1bb43926480
SHA512

1498d008c74b0b2728caa88541487d0795e5f87e773d4065fc6101728d7e937fd4655357f50815f3749fa1972d0518d0be359f3f55ad87297a3b97e74deefff7
SSDEEP

1536:AAM294HtCLXIomRlHbZKRozm/s/Bmo43lKrTCwCQbhjiXU3y0TjXVe9:Al29AtcIVvNYozm/RoI47biU317A9

Score

10^/10

A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware a310logger

A310logger Executable 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2712-0-0x0000000001340000-0x000000000135C000-memory.dmp	a310logger

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bc51d3bdc58bb7adb125867d39349390_exe32.exe

description	pid	process	target process
PID 2712 wrote to memory of 2632	2712	bc51d3bdc58bb7adb125867d39349390_exe32.exe	WerFault.exe
PID 2712 wrote to memory of 2632	2712	bc51d3bdc58bb7adb125867d39349390_exe32.exe	WerFault.exe
PID 2712 wrote to memory of 2632	2712	bc51d3bdc58bb7adb125867d39349390_exe32.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bc51d3bdc58bb7adb125867d39349390_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\bc51d3bdc58bb7adb125867d39349390_exe32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2712 -s 512
  2⤵
  PID:2632

memory/2712-0-0x0000000001340000-0x000000000135C000-memory.dmp

Filesize
112KB

Download
memory/2712-1-0x000007FEF5040000-0x000007FEF5A2C000-memory.dmp

Filesize
9.9MB

Download
memory/2712-2-0x000007FEF5040000-0x000007FEF5A2C000-memory.dmp

Filesize
9.9MB

Download