Overview

overview

10

Static

static

10

d4308d3282...27.exe

windows7_x64

10

d4308d3282...27.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    4294211s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    14-03-2022 03:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d4308d3282c98dc1f298484756d43ab8962f7e6c43eccd9c4ee29a253f5dba27.exe

  • Size

    823KB

  • MD5

    1f66154d69a4032a509979beb79f7e00

  • SHA1

    d89ad9add9987ae28f2141a3f4bbe3b323a0f4d9

  • SHA256

    d4308d3282c98dc1f298484756d43ab8962f7e6c43eccd9c4ee29a253f5dba27

  • SHA512

    aa74a86a6b96e254b3ad17d935af65fac8136d2809e9e5907fd50f2609a04da54cf6e60c4fa26823e8e60f3b2ea01c29853d0bde8f291e8d38b73a893c0b3520

Score
10/10
pandastealerdiscoveryspywarestealer

Malware Config

Signatures

  • Panda Stealer Payload 3 IoCs
  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer
  • Nirsoft 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4308d3282c98dc1f298484756d43ab8962f7e6c43eccd9c4ee29a253f5dba27.exe
    "C:\Users\Admin\AppData\Local\Temp\d4308d3282c98dc1f298484756d43ab8962f7e6c43eccd9c4ee29a253f5dba27.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Users\Admin\AppData\Local\Temp\LastActivityView.exe
      "C:\Users\Admin\AppData\Local\Temp\LastActivityView.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:956
    • C:\Users\Admin\AppData\Local\Temp\build.exe
      "C:\Users\Admin\AppData\Local\Temp\build.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1608

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\LastActivityView.exe
    MD5

    4a0e27af4bc47aa761a1751caf69a3dd

    SHA1

    0fb8f1dcd7f37deae356ecf4ec099ba66af5a0bf

    SHA256

    d8a736232b6ebed152a20e922ea2798fda89069786fdd8d526013585215c3046

    SHA512

    d600a995a63efdf96aa8c771464b889c4ceb9b9de66223983b125b17f6309cc56e32e35114481bab8ebcd1f61ce576baab5295f11aeeb035a687a1db7e58d1a8

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\build.exe
    MD5

    460dd3fb78fba3dc096b0ae1521345cb

    SHA1

    018a36dda3bb68ad6fa503cca2e70876fda1b7a2

    SHA256

    864fcc05d5b15ef8895108eceb63956bcbd81fb5e5c916c3bfa2450f6f67c3ee

    SHA512

    3b215031fc4d12940092a262e6d6d46487183f5cba1a40bd7473add57b6ddf9a43e33a8a8477e7c65e43172ccd921cc28def466a367f14436e6e6e2658ba410b

    Download Submit
  • \Users\Admin\AppData\Local\Temp\LastActivityView.exe
    MD5

    4a0e27af4bc47aa761a1751caf69a3dd

    SHA1

    0fb8f1dcd7f37deae356ecf4ec099ba66af5a0bf

    SHA256

    d8a736232b6ebed152a20e922ea2798fda89069786fdd8d526013585215c3046

    SHA512

    d600a995a63efdf96aa8c771464b889c4ceb9b9de66223983b125b17f6309cc56e32e35114481bab8ebcd1f61ce576baab5295f11aeeb035a687a1db7e58d1a8

    Download Submit
  • \Users\Admin\AppData\Local\Temp\build.exe
    MD5

    460dd3fb78fba3dc096b0ae1521345cb

    SHA1

    018a36dda3bb68ad6fa503cca2e70876fda1b7a2

    SHA256

    864fcc05d5b15ef8895108eceb63956bcbd81fb5e5c916c3bfa2450f6f67c3ee

    SHA512

    3b215031fc4d12940092a262e6d6d46487183f5cba1a40bd7473add57b6ddf9a43e33a8a8477e7c65e43172ccd921cc28def466a367f14436e6e6e2658ba410b

    Download Submit
  • \Users\Admin\AppData\Local\Temp\build.exe
    MD5

    460dd3fb78fba3dc096b0ae1521345cb

    SHA1

    018a36dda3bb68ad6fa503cca2e70876fda1b7a2

    SHA256

    864fcc05d5b15ef8895108eceb63956bcbd81fb5e5c916c3bfa2450f6f67c3ee

    SHA512

    3b215031fc4d12940092a262e6d6d46487183f5cba1a40bd7473add57b6ddf9a43e33a8a8477e7c65e43172ccd921cc28def466a367f14436e6e6e2658ba410b

    Download Submit
  • memory/1632-54-0x0000000076141000-0x0000000076143000-memory.dmp
    Filesize

    8KB

    Download