Managed XDR

20250630_fp_100_5.eml (META Stealer) — malware analysis report

File info

Filename
20250630_fp_100_5.eml
File type
RFC 822 mail, ASCII text, with CRLF, LF line terminators
File size
2.8 MB
First seen
Last seen

Environment

w10/x86 en

Hashes

SHA1
7e57a4b0f86dc88f04fa14cf0ea10f240365910f
SHA256
ddd38b0e2db9755284e7010e315843194eef7a6f1adf31f67a805775b82091b8
MD5
0aa85b1813ae18d86846d967a146482b

Malwares

  • META Stealer

Signatures

Execution

T1047 antivm_wmi: Uses WMI to detect virtual environment
T1047 has_wmi: Executes one or several WMI requests

Persistence

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup

Privilege Escalation

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1055.002 inject_write_pe: Writes PE file to another process's memory
T1055.012 injection_runpe: Injects code into another process
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1218 bypass_dev_utils: Executing .NET utility in a suspended state, potentially for injection
T1055.002 inject_write_pe: Writes PE file to another process's memory
T1055.012 injection_runpe: Injects code into another process
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1070 stealth_window: A process created a hidden window

Credential Access

T1552 infostealer_browser: Retrieves personal information from local Internet browsers
T1503 infostealer_browser: Retrieves personal information from local Internet browsers
T1552 infostealer_im: Collects information about installed messengers
T1552.001 infostealer_bitcoin: Attempts to obtain access to Bitcoin/ALTCoin wallets
T1552.002 infostealer_steam: Attempts to collect information about Steam account
T1552 infostealer_mail: Collects personal data from local email clients
T1552.001 infostealer_vpn: Collects information about installed VPN software
T1555.003 cookie_files: Accesses cookie files
T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager
T1552 cookie_files: Accesses cookie files

Discovery

T1033 recon_beacon: The process has sent information about the computer over the network
T1518 recon_programs: Collects information about installed programs
T1518.001 wmi_check_av: Uses WMI to check for installed antivirus software
T1057 has_wmi: Executes one or several WMI requests
T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1082 has_wmi: Executes one or several WMI requests
T1518 locates_browser: Attempts to identify where browsers are installed

Collection

T1114 infostealer_mail: Collects personal data from local email clients

Command and Control

T1071.001 recon_beacon: The process has sent information about the computer over the network

Exfiltration

T1022 encrypts_pc_info: Collects and encrypts information about the computer (possibly for exfiltration)

Other

yara_rules: Static rules
creates_exe: Creates executable files in the file system
copies_self: Creates a copy of itself
no_graphical_activity: No graphic activity
dotnet_suspicious_resources_names: Dotnet program has suspicious resources names
create_rpc_bindings: Creates RPC connection
creates_suspended_process: Creates suspended process
message_box: Displays a message
dotnet_obfuscated: Dotnet program is potentially obfuscated
checktokenmembership: Checks user token with CheckTokenMembership call
dotnet_suspicious_entrypoint: Dotnet program has suspicious entrypoint

Related reports

Managed XDR