Analysis
- max time kernel
80s - max time network
91s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
26/04/2023, 17:30
Behavioral task
behavioral1
Sample
Pandora new crack - Copy.exe
Resource
win7-20230220-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Pandora new crack - Copy.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target Pandora new crack - Copy.exe
- Size 710.8MB
- Sample230426-v3klyaah42
- SHA256 635d73bffa652845629082094777732d3f37482ce2d24e72f15cd07977c49bbf
- MD5 f8542e3fd05d0ccdad3a7a56fa9dc675
- SHA1 a50107bfa0429e3c8f9e80710057e8f1b620a3d5
- SHA512 135b9472e053a24245191969d44f2c835703f8351357172755f4a34989ce1a211adfcd79700677cc2a3a23dcd8927b2e9e3db4c4a11130bab11f1a71566acf44
- SSDEEP 24576:5i2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgLc:oTq24GjdGSiqkqXfd+/9AqYanieKd
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
stealerium
C2
-
https://discord.com/api/webhooks/1100795014843469874/QQny5mMq7HU-Eb1qYkLt5wXKkY7L_8SqtGW55nyYB2tpw-qDUtmemjTcPU9kn2V86aQN
Signatures
- Stealerium
An open source info stealer written in C# first seen in May 2022.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Pandora new crack - Copy.exe Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Pandora new crack - Copy.exe Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Pandora new crack - Copy.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 27 icanhazip.com - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 Pandora new crack - Copy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Pandora new crack - Copy.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 1452 Pandora new crack - Copy.exe 4912 taskmgr.exe 4912 taskmgr.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 4912 taskmgr.exe 4912 taskmgr.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 4912 taskmgr.exe 4912 taskmgr.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 4912 taskmgr.exe 4912 taskmgr.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 4912 taskmgr.exe 4912 taskmgr.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 4912 taskmgr.exe 4912 taskmgr.exe 1452 Pandora new crack - Copy.exe 1452 Pandora new crack - Copy.exe 4912 taskmgr.exe 4912 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1452 Pandora new crack - Copy.exe Token: SeSecurityPrivilege 1960 msiexec.exe Token: SeDebugPrivilege 4912 taskmgr.exe Token: SeSystemProfilePrivilege 4912 taskmgr.exe Token: SeCreateGlobalPrivilege 4912 taskmgr.exe - Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe - Suspicious use of SendNotifyMessage 57 IoCs
pid Process 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1452 Pandora new crack - Copy.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1452 wrote to memory of 1048 1452 Pandora new crack - Copy.exe 90 PID 1452 wrote to memory of 1048 1452 Pandora new crack - Copy.exe 90 PID 1452 wrote to memory of 1048 1452 Pandora new crack - Copy.exe 90 PID 1048 wrote to memory of 2324 1048 cmd.exe 92 PID 1048 wrote to memory of 2324 1048 cmd.exe 92 PID 1048 wrote to memory of 2324 1048 cmd.exe 92 PID 1048 wrote to memory of 3208 1048 cmd.exe 94 PID 1048 wrote to memory of 3208 1048 cmd.exe 94 PID 1048 wrote to memory of 3208 1048 cmd.exe 94 PID 1048 wrote to memory of 2024 1048 cmd.exe 95 PID 1048 wrote to memory of 2024 1048 cmd.exe 95 PID 1048 wrote to memory of 2024 1048 cmd.exe 95 PID 1452 wrote to memory of 3808 1452 Pandora new crack - Copy.exe 98 PID 1452 wrote to memory of 3808 1452 Pandora new crack - Copy.exe 98 PID 1452 wrote to memory of 3808 1452 Pandora new crack - Copy.exe 98 PID 3808 wrote to memory of 3300 3808 cmd.exe 100 PID 3808 wrote to memory of 3300 3808 cmd.exe 100 PID 3808 wrote to memory of 3300 3808 cmd.exe 100 PID 3808 wrote to memory of 5092 3808 cmd.exe 101 PID 3808 wrote to memory of 5092 3808 cmd.exe 101 PID 3808 wrote to memory of 5092 3808 cmd.exe 101 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Pandora new crack - Copy.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Pandora new crack - Copy.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pandora new crack - Copy.exe"C:\Users\Admin\AppData\Local\Temp\Pandora new crack - Copy.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1452 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:2324
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵PID:3208
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:3300
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵PID:5092
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4912
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\5b978dd92108ec85f4661c14a1aded56\Admin@WEYPCEWN_en-US\Browsers\Firefox\Bookmarks.txt
- Size 105B
- SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
- MD5 2e9d094dda5cdc3ce6519f75943a4ff4
- SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
- SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\5b978dd92108ec85f4661c14a1aded56\Admin@WEYPCEWN_en-US\Directories\OneDrive.txt
- Size 25B
- SHA256 8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
- MD5 966247eb3ee749e21597d73c4176bd52
- SHA1 1e9e63c2872cef8f015d4b888eb9f81b00a35c79
- SHA512 bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\5b978dd92108ec85f4661c14a1aded56\Admin@WEYPCEWN_en-US\Directories\Startup.txt
- Size 24B
- SHA256 889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483
- MD5 68c93da4981d591704cea7b71cebfb97
- SHA1 fd0f8d97463cd33892cc828b4ad04e03fc014fa6
- SHA512 63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\5b978dd92108ec85f4661c14a1aded56\Admin@WEYPCEWN_en-US\Directories\Videos.txt
- Size 23B
- SHA256 a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
- MD5 1fddbf1169b6c75898b86e7e24bc7c1f
- SHA1 d2091060cb5191ff70eb99c0088c182e80c20f8c
- SHA512 20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\5b978dd92108ec85f4661c14a1aded56\Admin@WEYPCEWN_en-US\System\Apps.txt
- Size 4KB
- SHA256 fae83368d139ae81745a2faf8914ad865776d51ce58f4dddbfd8e7da5befd69e
- MD5 1cb83ad1d8562c5a62b25c094b189250
- SHA1 977459bafcd759fd7b37186c34971b392294e453
- SHA512 8229785f4754dda7d14449f1457b716ac9c6cfd2d73da7f8429af1a3b3328be450aa6281688d3903fcae66fd457cc625e3e6fdb331d464885c1598814d09ddf6
- SSDEEP 96:OfpqX3fpqXPfpqmNpJf1QWEfHpKEfHDvuf1i2fCDr82fCTRpqffOtrhffOS08coq:wpq/pq3pqs1n2Hw2HE1i4CDr84C6OLOv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\5b978dd92108ec85f4661c14a1aded56\Admin@WEYPCEWN_en-US\System\Debug.txt
- Size 293B
- SHA256 ad32e16bd551dcd508c567028a1b24b185a2eb20101275d570f9f6eb1d7a364d
- MD5 b6def519adcc4357459e3fd628ba8a03
- SHA1 950e71ed245e1a6363f82f4bf8b74c5cd63c1ce4
- SHA512 f96750679a7da3724873b59aa8b343886ab2d048409f14ae5dee8ffb93c229e137a9207d0a832b04ff62fe102fcd894dd7e74dcd928b1ce626470c0ce84f9449
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\5b978dd92108ec85f4661c14a1aded56\Admin@WEYPCEWN_en-US\System\Process.txt
- Size 4KB
- SHA256 2fd10c1c6ae03ba182e867784ddad129c08af194b9a92c8796fd62169adc39e1
- MD5 57d4894ae3c22de9f8091b03ed17b765
- SHA1 d0a437d61ce353016b5ad49b08807df04c1060bd
- SHA512 ee131a13fbbd62d81cb5f9367543f4a3064d0bf0c9e855745b7c3a8c03edd9fd1e4d1998892471ef456c9bbbd97f7cd5ba7c35d709768798eefaa2a668caaf24
- SSDEEP 24:WFTJ8VOx+23OPtnvnCpswkpDBTXq2dLbpGvmvCLqsea8sonpPpQsbJQUj+mpcpK+:GUR234tvDL98vUmHvXrO2CFVWzbc3/G
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\5b978dd92108ec85f4661c14a1aded56\Admin@WEYPCEWN_en-US\System\ProductKey.txt
- Size 29B
- SHA256 f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
- MD5 71eb5479298c7afc6d126fa04d2a9bde
- SHA1 a9b3d5505cf9f84bb6c2be2acece53cb40075113
- SHA512 7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\5b978dd92108ec85f4661c14a1aded56\msgid.dat
- Size 19B
- SHA256 d41a0c553273e86d6707163946c5e1d8578794400e4fc62c6fd84a9d6ea69719
- MD5 011ed7cfd26f92fd309e828543254bcf
- SHA1 4804fd9279d504dcea63dc0b970cccc3b003836f
- SHA512 a6db9c87db769798911675f1ee902557b0afd0c0aae9d6ce83e6e8e1ff28c0182f2579528f8575631f23afc726a577d2b346cdf0c9ea68f2e0c9c8ceee4f1282
- MD5 SHA1 SHA512