Overview

overview

10

Static

static

8

6136332042...c5.exe

windows7_x64

10

6136332042...c5.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    157s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    19-03-2022 15:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe

  • Size

    2.5MB

  • MD5

    ed08f49312feadd6690473e54ea2ebea

  • SHA1

    3aac4c372c6fbef8370434ac97172ebd9f39e105

  • SHA256

    61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5

  • SHA512

    9817fdf570e9334f649ec908f2d223803d449e62ba9793d35af8ce658551c7136e4d76f55daa01d540bbb1c0a3d021cd2af339c0d8c31b810acad9f1daac218e

Score
10/10
pandastealerspywarestealervmprotect

Malware Config

Signatures

  • Panda Stealer Payload 2 IoCs
  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer
  • Executes dropped EXE 2 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe
    "C:\Users\Admin\AppData\Local\Temp\61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe
      "C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3584
    • C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\Cheat_SanyaTop.exe
      "C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\Cheat_SanyaTop.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe
    MD5

    2044768a6469f7a339276fb6a00dbf1a

    SHA1

    6aab5685f6e9d45fafd703f8a51d7606840387fc

    SHA256

    9879bb4f831233d2a36ace56535ed479f853c7a878d60f46a93fe07d1d371e67

    SHA512

    d616e0f12b0325cf864a9cb6298f4ded87548b2307572ba8447b6594b8ce14a8fb181a56d95b454b9ae63d9261ade15d25b3d6bceb1e794bdb8d913622761d9f

    Download Submit
  • C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe
    MD5

    2044768a6469f7a339276fb6a00dbf1a

    SHA1

    6aab5685f6e9d45fafd703f8a51d7606840387fc

    SHA256

    9879bb4f831233d2a36ace56535ed479f853c7a878d60f46a93fe07d1d371e67

    SHA512

    d616e0f12b0325cf864a9cb6298f4ded87548b2307572ba8447b6594b8ce14a8fb181a56d95b454b9ae63d9261ade15d25b3d6bceb1e794bdb8d913622761d9f

    Download Submit
  • C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\Cheat_SanyaTop.exe
    MD5

    c98771c7a517e4a9cb1e603a115e6c80

    SHA1

    0154f03560051015cdf49c075961c8144bd65359

    SHA256

    56924494751713a5c22ada3f11c812a2ecf4957e442fc0bf52194aae4f24c09e

    SHA512

    c48747fe27708a0b14da7c7007910b5464682947367477378e94d2edcd105eae510bc27eb9ddf9c0820e164b71da297e230d680d9ec6b94948f97d9869a94095

    Download Submit
  • C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\Cheat_SanyaTop.exe
    MD5

    c98771c7a517e4a9cb1e603a115e6c80

    SHA1

    0154f03560051015cdf49c075961c8144bd65359

    SHA256

    56924494751713a5c22ada3f11c812a2ecf4957e442fc0bf52194aae4f24c09e

    SHA512

    c48747fe27708a0b14da7c7007910b5464682947367477378e94d2edcd105eae510bc27eb9ddf9c0820e164b71da297e230d680d9ec6b94948f97d9869a94095

    Download Submit
  • memory/1520-134-0x0000000000A40000-0x0000000000F63000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/1520-136-0x0000000000A40000-0x0000000000F63000-memory.dmp
    Filesize

    5.1MB

    Download
  • memory/1520-137-0x0000000077B70000-0x0000000077B71000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1520-138-0x0000000075E20000-0x0000000075E21000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2516-143-0x0000000074A00000-0x00000000751B0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/2516-144-0x0000000000E50000-0x0000000000F14000-memory.dmp
    Filesize

    784KB

    Download
  • memory/2516-145-0x0000000005980000-0x0000000005981000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2516-146-0x0000000005820000-0x0000000005842000-memory.dmp
    Filesize

    136KB

    Download