Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
15-02-2023 17:01
Static task
static1
Behavioral task
behavioral1
Sample
04b1711beba9284f46e355b5d22eed54.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
04b1711beba9284f46e355b5d22eed54.exe
Resource
win10v2004-20221111-en
General
-
Target
04b1711beba9284f46e355b5d22eed54.exe
-
Size
189KB
-
MD5
04b1711beba9284f46e355b5d22eed54
-
SHA1
a81642aec480505036852d22d5b8ee2bd76e604f
-
SHA256
928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907
-
SHA512
d9c09a5761fa8637853c705e3bb5489f43bea5a36092712e7021e701bd2ca10edb9531653c8c58e5014afef243231d17ded7dac820e3225886ea57c1be8a90f9
-
SSDEEP
3072:d/ipHQ6o8/MXs3pTtKSKg4XTZLNJjgn1ZiYqRr7xW:JoHU8/MXs3pBqT9zjmWRr
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4856-133-0x0000000000700000-0x0000000000709000-memory.dmp family_smokeloader -
Panda Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1028-145-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral2/memory/1028-146-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral2/memory/1028-147-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral2/memory/1028-148-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
91EF.exe9859.exeA24D.exepid process 4028 91EF.exe 3856 9859.exe 5060 A24D.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
9859.exedescription pid process target process PID 3856 set thread context of 1028 3856 9859.exe InstallUtil.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 644 5060 WerFault.exe A24D.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
04b1711beba9284f46e355b5d22eed54.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 04b1711beba9284f46e355b5d22eed54.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 04b1711beba9284f46e355b5d22eed54.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 04b1711beba9284f46e355b5d22eed54.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
04b1711beba9284f46e355b5d22eed54.exepid process 4856 04b1711beba9284f46e355b5d22eed54.exe 4856 04b1711beba9284f46e355b5d22eed54.exe 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 764 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
04b1711beba9284f46e355b5d22eed54.exepid process 4856 04b1711beba9284f46e355b5d22eed54.exe 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
A24D.exedescription pid process Token: SeShutdownPrivilege 764 Token: SeCreatePagefilePrivilege 764 Token: SeShutdownPrivilege 764 Token: SeCreatePagefilePrivilege 764 Token: SeShutdownPrivilege 764 Token: SeCreatePagefilePrivilege 764 Token: SeShutdownPrivilege 764 Token: SeCreatePagefilePrivilege 764 Token: SeDebugPrivilege 5060 A24D.exe Token: SeShutdownPrivilege 764 Token: SeCreatePagefilePrivilege 764 -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
9859.exedescription pid process target process PID 764 wrote to memory of 4028 764 91EF.exe PID 764 wrote to memory of 4028 764 91EF.exe PID 764 wrote to memory of 3856 764 9859.exe PID 764 wrote to memory of 3856 764 9859.exe PID 764 wrote to memory of 3856 764 9859.exe PID 3856 wrote to memory of 1028 3856 9859.exe InstallUtil.exe PID 3856 wrote to memory of 1028 3856 9859.exe InstallUtil.exe PID 3856 wrote to memory of 1028 3856 9859.exe InstallUtil.exe PID 3856 wrote to memory of 1028 3856 9859.exe InstallUtil.exe PID 3856 wrote to memory of 1028 3856 9859.exe InstallUtil.exe PID 3856 wrote to memory of 1028 3856 9859.exe InstallUtil.exe PID 3856 wrote to memory of 1028 3856 9859.exe InstallUtil.exe PID 3856 wrote to memory of 1028 3856 9859.exe InstallUtil.exe PID 3856 wrote to memory of 1028 3856 9859.exe InstallUtil.exe PID 3856 wrote to memory of 1028 3856 9859.exe InstallUtil.exe PID 764 wrote to memory of 5060 764 A24D.exe PID 764 wrote to memory of 5060 764 A24D.exe PID 764 wrote to memory of 5060 764 A24D.exe PID 764 wrote to memory of 5068 764 explorer.exe PID 764 wrote to memory of 5068 764 explorer.exe PID 764 wrote to memory of 5068 764 explorer.exe PID 764 wrote to memory of 5068 764 explorer.exe PID 764 wrote to memory of 1972 764 explorer.exe PID 764 wrote to memory of 1972 764 explorer.exe PID 764 wrote to memory of 1972 764 explorer.exe PID 764 wrote to memory of 1184 764 explorer.exe PID 764 wrote to memory of 1184 764 explorer.exe PID 764 wrote to memory of 1184 764 explorer.exe PID 764 wrote to memory of 1184 764 explorer.exe PID 764 wrote to memory of 3620 764 explorer.exe PID 764 wrote to memory of 3620 764 explorer.exe PID 764 wrote to memory of 3620 764 explorer.exe PID 764 wrote to memory of 2796 764 explorer.exe PID 764 wrote to memory of 2796 764 explorer.exe PID 764 wrote to memory of 2796 764 explorer.exe PID 764 wrote to memory of 2796 764 explorer.exe PID 764 wrote to memory of 3224 764 explorer.exe PID 764 wrote to memory of 3224 764 explorer.exe PID 764 wrote to memory of 3224 764 explorer.exe PID 764 wrote to memory of 3224 764 explorer.exe PID 764 wrote to memory of 4548 764 explorer.exe PID 764 wrote to memory of 4548 764 explorer.exe PID 764 wrote to memory of 4548 764 explorer.exe PID 764 wrote to memory of 4548 764 explorer.exe PID 764 wrote to memory of 3460 764 explorer.exe PID 764 wrote to memory of 3460 764 explorer.exe PID 764 wrote to memory of 3460 764 explorer.exe PID 764 wrote to memory of 2368 764 explorer.exe PID 764 wrote to memory of 2368 764 explorer.exe PID 764 wrote to memory of 2368 764 explorer.exe PID 764 wrote to memory of 2368 764 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04b1711beba9284f46e355b5d22eed54.exe"C:\Users\Admin\AppData\Local\Temp\04b1711beba9284f46e355b5d22eed54.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\91EF.exeC:\Users\Admin\AppData\Local\Temp\91EF.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9859.exeC:\Users\Admin\AppData\Local\Temp\9859.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\A24D.exeC:\Users\Admin\AppData\Local\Temp\A24D.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 12242⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5060 -ip 50601⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\91EF.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\91EF.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\9859.exeFilesize
3.1MB
MD59be366e3eead805c905977cf03900368
SHA12b54c4b41e4cf54beb888bad6b795d9bc0179554
SHA2561ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847
SHA512d8adccf92392248f5674cc1b69c9533add0913b0307194d41ba78d81b533f57ec4b39e225bd0656441f70214a01cf0a9d64adcf307e06548f0b2f138bc68871f
-
C:\Users\Admin\AppData\Local\Temp\9859.exeFilesize
3.1MB
MD59be366e3eead805c905977cf03900368
SHA12b54c4b41e4cf54beb888bad6b795d9bc0179554
SHA2561ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847
SHA512d8adccf92392248f5674cc1b69c9533add0913b0307194d41ba78d81b533f57ec4b39e225bd0656441f70214a01cf0a9d64adcf307e06548f0b2f138bc68871f
-
C:\Users\Admin\AppData\Local\Temp\A24D.exeFilesize
299KB
MD54044277808862af81c94098f33ef040d
SHA1d249a425325fb6cf3ff431450492e5e8467cfe07
SHA25600f8d989336d2e4e3a4544f8bdb5ae97500f16e3d0dc262a78d7e75f9abe3288
SHA512cc88af60599447479d49b0ffe2ef78a211a4b597d7171ab8105595f4809c0e363e5dba66b5f0cf3b2957fc5df1b9589e730d10235af0dff5bdbd957686435039
-
C:\Users\Admin\AppData\Local\Temp\A24D.exeFilesize
299KB
MD54044277808862af81c94098f33ef040d
SHA1d249a425325fb6cf3ff431450492e5e8467cfe07
SHA25600f8d989336d2e4e3a4544f8bdb5ae97500f16e3d0dc262a78d7e75f9abe3288
SHA512cc88af60599447479d49b0ffe2ef78a211a4b597d7171ab8105595f4809c0e363e5dba66b5f0cf3b2957fc5df1b9589e730d10235af0dff5bdbd957686435039
-
memory/1028-147-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/1028-148-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/1028-144-0x0000000000000000-mapping.dmp
-
memory/1028-145-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/1028-146-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/1184-197-0x0000000000680000-0x0000000000685000-memory.dmpFilesize
20KB
-
memory/1184-167-0x0000000000670000-0x0000000000679000-memory.dmpFilesize
36KB
-
memory/1184-171-0x0000000000680000-0x0000000000685000-memory.dmpFilesize
20KB
-
memory/1184-164-0x0000000000000000-mapping.dmp
-
memory/1972-196-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/1972-159-0x0000000000000000-mapping.dmp
-
memory/1972-166-0x00000000001D0000-0x00000000001DF000-memory.dmpFilesize
60KB
-
memory/1972-165-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/2368-203-0x00000000006B0000-0x00000000006B8000-memory.dmpFilesize
32KB
-
memory/2368-193-0x00000000006B0000-0x00000000006B8000-memory.dmpFilesize
32KB
-
memory/2368-191-0x0000000000000000-mapping.dmp
-
memory/2368-194-0x00000000006A0000-0x00000000006AB000-memory.dmpFilesize
44KB
-
memory/2796-175-0x00000000010C0000-0x00000000010E2000-memory.dmpFilesize
136KB
-
memory/2796-176-0x0000000001090000-0x00000000010B7000-memory.dmpFilesize
156KB
-
memory/2796-174-0x0000000000000000-mapping.dmp
-
memory/2796-199-0x00000000010C0000-0x00000000010E2000-memory.dmpFilesize
136KB
-
memory/3224-179-0x0000000000F40000-0x0000000000F49000-memory.dmpFilesize
36KB
-
memory/3224-178-0x0000000000F50000-0x0000000000F55000-memory.dmpFilesize
20KB
-
memory/3224-177-0x0000000000000000-mapping.dmp
-
memory/3224-200-0x0000000000F50000-0x0000000000F55000-memory.dmpFilesize
20KB
-
memory/3460-187-0x0000000000000000-mapping.dmp
-
memory/3460-188-0x0000000001040000-0x0000000001047000-memory.dmpFilesize
28KB
-
memory/3460-202-0x0000000001040000-0x0000000001047000-memory.dmpFilesize
28KB
-
memory/3460-189-0x0000000001030000-0x000000000103D000-memory.dmpFilesize
52KB
-
memory/3620-169-0x0000000000000000-mapping.dmp
-
memory/3620-172-0x0000000000D80000-0x0000000000D86000-memory.dmpFilesize
24KB
-
memory/3620-173-0x0000000000D70000-0x0000000000D7C000-memory.dmpFilesize
48KB
-
memory/3620-198-0x0000000000D80000-0x0000000000D86000-memory.dmpFilesize
24KB
-
memory/3856-141-0x0000000000000000-mapping.dmp
-
memory/4028-136-0x0000000000000000-mapping.dmp
-
memory/4028-140-0x00007FFB75020000-0x00007FFB75AE1000-memory.dmpFilesize
10.8MB
-
memory/4028-139-0x0000000000DF0000-0x0000000000DF8000-memory.dmpFilesize
32KB
-
memory/4548-201-0x0000000000470000-0x0000000000476000-memory.dmpFilesize
24KB
-
memory/4548-184-0x0000000000470000-0x0000000000476000-memory.dmpFilesize
24KB
-
memory/4548-185-0x0000000000460000-0x000000000046B000-memory.dmpFilesize
44KB
-
memory/4548-182-0x0000000000000000-mapping.dmp
-
memory/4856-135-0x0000000000400000-0x0000000000561000-memory.dmpFilesize
1.4MB
-
memory/4856-134-0x0000000000400000-0x0000000000561000-memory.dmpFilesize
1.4MB
-
memory/4856-133-0x0000000000700000-0x0000000000709000-memory.dmpFilesize
36KB
-
memory/4856-132-0x0000000000738000-0x000000000074B000-memory.dmpFilesize
76KB
-
memory/5060-158-0x0000000000400000-0x000000000057D000-memory.dmpFilesize
1.5MB
-
memory/5060-160-0x0000000005370000-0x0000000005988000-memory.dmpFilesize
6.1MB
-
memory/5060-186-0x0000000006F50000-0x0000000006F6E000-memory.dmpFilesize
120KB
-
memory/5060-181-0x0000000006730000-0x00000000068F2000-memory.dmpFilesize
1.8MB
-
memory/5060-155-0x0000000004DC0000-0x0000000005364000-memory.dmpFilesize
5.6MB
-
memory/5060-170-0x00000000064A0000-0x0000000006532000-memory.dmpFilesize
584KB
-
memory/5060-163-0x0000000005990000-0x00000000059CC000-memory.dmpFilesize
240KB
-
memory/5060-190-0x0000000000809000-0x0000000000836000-memory.dmpFilesize
180KB
-
memory/5060-192-0x0000000000400000-0x000000000057D000-memory.dmpFilesize
1.5MB
-
memory/5060-162-0x0000000004C90000-0x0000000004D9A000-memory.dmpFilesize
1.0MB
-
memory/5060-149-0x0000000000000000-mapping.dmp
-
memory/5060-180-0x0000000006650000-0x00000000066C6000-memory.dmpFilesize
472KB
-
memory/5060-161-0x0000000004C70000-0x0000000004C82000-memory.dmpFilesize
72KB
-
memory/5060-156-0x0000000000809000-0x0000000000836000-memory.dmpFilesize
180KB
-
memory/5060-157-0x0000000002190000-0x00000000021F2000-memory.dmpFilesize
392KB
-
memory/5060-168-0x0000000005C90000-0x0000000005CF6000-memory.dmpFilesize
408KB
-
memory/5060-183-0x0000000006910000-0x0000000006E3C000-memory.dmpFilesize
5.2MB
-
memory/5068-195-0x0000000000500000-0x0000000000507000-memory.dmpFilesize
28KB
-
memory/5068-152-0x0000000000000000-mapping.dmp
-
memory/5068-153-0x0000000000500000-0x0000000000507000-memory.dmpFilesize
28KB
-
memory/5068-154-0x00000000004F0000-0x00000000004FB000-memory.dmpFilesize
44KB