Analysis
-
max time kernel
9s -
max time network
40s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-06-2021 18:39
General
-
Target
Install.sfx.exe
-
Size
605KB
-
MD5
c9f95502be073fbef379c92edebb8644
-
SHA1
3e3ad24013f3d3e3d1cb81ae408804f32da44bf9
-
SHA256
500e8c5cbd452c132e796bf19397c831730c34496f3d07e9b88258fc4ca07746
-
SHA512
51c7cc0d4f12d12bc07e165335f005c39546b6f03cdc303dac304926e4e8eb03226ca6bda0e5813751de8fd4c4c9c45af54af55222b5505ebdd2be6205242b35
Score
10/10
Malware Config
Signatures
-
Panda Stealer Payload 5 IoCs
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install.sfx.exe"C:\Users\Admin\AppData\Local\Temp\Install.sfx.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bui3ld.exe"C:\Users\Admin\AppData\Local\Temp\bui3ld.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
4KB