Analysis
-
max time kernel
210s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-02-2023 05:59
Static task
static1
Behavioral task
behavioral1
Sample
MidNight - CRACKED.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
MidNight - CRACKED.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
MidNight - CRACKED.exe
-
Size
1.0MB
-
MD5
58ca1e23ef8de741043ccb41431b091a
-
SHA1
aca6ff224cc2d42dc14d66123bc018a10cd27445
-
SHA256
e52afa16e426ed5b530dc3fc1bcac33dc99ca772ff841b7c0bbbf93e4e7c7fed
-
SHA512
ba90b03bb76b45f79824d8ff415872f3a230b2dd0d50cf644938b2179d16d7dc09ffe5aa048cad089229ba84f7dd8167af747c98d0b6c70eb24208cd8e867c56
-
SSDEEP
24576:rTbBv5rUWXm04zMPIPhA53hJTB4tniG+tNd7:1B3m7/50NWt+/t
Malware Config
Signatures
-
Panda Stealer payload 5 IoCs
resource yara_rule behavioral1/files/0x0008000000005c50-55.dat family_pandastealer behavioral1/files/0x0008000000005c50-56.dat family_pandastealer behavioral1/files/0x0008000000005c50-57.dat family_pandastealer behavioral1/files/0x0008000000005c50-59.dat family_pandastealer behavioral1/files/0x0008000000005c50-64.dat family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Executes dropped EXE 1 IoCs
pid Process 892 10yPnSco9W4zfRozfL41HdUHsAscfkda.exe -
Loads dropped DLL 3 IoCs
pid Process 1644 MidNight - CRACKED.exe 1644 MidNight - CRACKED.exe 1644 MidNight - CRACKED.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 892 10yPnSco9W4zfRozfL41HdUHsAscfkda.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1692 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1692 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1328 DllHost.exe 1328 DllHost.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe 1692 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1644 wrote to memory of 892 1644 MidNight - CRACKED.exe 27 PID 1644 wrote to memory of 892 1644 MidNight - CRACKED.exe 27 PID 1644 wrote to memory of 892 1644 MidNight - CRACKED.exe 27 PID 1644 wrote to memory of 892 1644 MidNight - CRACKED.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\MidNight - CRACKED.exe"C:\Users\Admin\AppData\Local\Temp\MidNight - CRACKED.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\10yPnSco9W4zfRozfL41HdUHsAscfkda.exe"C:\Users\Admin\AppData\Local\Temp\10yPnSco9W4zfRozfL41HdUHsAscfkda.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:892
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:1328
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1692
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
632KB
MD5e249bcd1e893795c71351bf62480c6b6
SHA1e92158f135788d0916f2e293011b3568d498c092
SHA256b15a74b64a63a348919203a024f8c8aa715c2ff21685e26da14f1be4a00520c5
SHA5128bfc855dc917a098f3795ef11815593ab29f02db7d219bfcc25a4ddc957f0e0ee0dc44c18fb3f50c9c11f89f3cc71f8aafb7ee1208429f7ee3bc492cc51d5a91
-
Filesize
632KB
MD5e249bcd1e893795c71351bf62480c6b6
SHA1e92158f135788d0916f2e293011b3568d498c092
SHA256b15a74b64a63a348919203a024f8c8aa715c2ff21685e26da14f1be4a00520c5
SHA5128bfc855dc917a098f3795ef11815593ab29f02db7d219bfcc25a4ddc957f0e0ee0dc44c18fb3f50c9c11f89f3cc71f8aafb7ee1208429f7ee3bc492cc51d5a91
-
Filesize
206KB
MD5df04e5d97b4f113febcc037aae0fe6a5
SHA13dd1f95edc40395d1984542f5daef9ea53c0925c
SHA25641419008feab09129aec758571984915fbbc191c517a58b9245df86b86820450
SHA51285c54de7e2121df1a94f7128cf1c5723c07f5b09ae61d8f63a7398df292e0d54eef87d9a39a0c8d8dd22b9a7883dc52eeda388b11aab21d06365267a55b85b2a
-
Filesize
632KB
MD5e249bcd1e893795c71351bf62480c6b6
SHA1e92158f135788d0916f2e293011b3568d498c092
SHA256b15a74b64a63a348919203a024f8c8aa715c2ff21685e26da14f1be4a00520c5
SHA5128bfc855dc917a098f3795ef11815593ab29f02db7d219bfcc25a4ddc957f0e0ee0dc44c18fb3f50c9c11f89f3cc71f8aafb7ee1208429f7ee3bc492cc51d5a91
-
Filesize
632KB
MD5e249bcd1e893795c71351bf62480c6b6
SHA1e92158f135788d0916f2e293011b3568d498c092
SHA256b15a74b64a63a348919203a024f8c8aa715c2ff21685e26da14f1be4a00520c5
SHA5128bfc855dc917a098f3795ef11815593ab29f02db7d219bfcc25a4ddc957f0e0ee0dc44c18fb3f50c9c11f89f3cc71f8aafb7ee1208429f7ee3bc492cc51d5a91
-
Filesize
632KB
MD5e249bcd1e893795c71351bf62480c6b6
SHA1e92158f135788d0916f2e293011b3568d498c092
SHA256b15a74b64a63a348919203a024f8c8aa715c2ff21685e26da14f1be4a00520c5
SHA5128bfc855dc917a098f3795ef11815593ab29f02db7d219bfcc25a4ddc957f0e0ee0dc44c18fb3f50c9c11f89f3cc71f8aafb7ee1208429f7ee3bc492cc51d5a91
