Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-12-2023 01:33
Static task
static1
Behavioral task
behavioral1
Sample
SENSIXDPANNEL.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
SENSIXDPANNEL.exe
Resource
win10v2004-20231215-en
General
-
Target
SENSIXDPANNEL.exe
-
Size
433KB
-
MD5
40cf5b7e5c505da78a7f66d2950effbf
-
SHA1
abf961c5b9fae57411a195a00b4c7093d2fe0bc4
-
SHA256
911221ce521f77139ecfa2a277c277aaee6bff7094d9c5b31b893a4b104dea48
-
SHA512
08cbfc073c2d0f63a9b2711a81dd30809cb87eb2310ffd5b2a582a1e9ca0ebd5956093e83453310cba25a403aa28bf7cfcb3725a017188d48e66cccccb190bc5
-
SSDEEP
12288:pyVG1u73Do/eGm5uRWlgfS7BCag7MJQIGhJNsx61V0wrY4FS9:IGS6WRN+JGxS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Q6O.exepid process 2224 Q6O.exe -
Loads dropped DLL 5 IoCs
Processes:
SENSIXDPANNEL.exeWerFault.exepid process 2380 SENSIXDPANNEL.exe 2380 SENSIXDPANNEL.exe 2552 WerFault.exe 2552 WerFault.exe 2552 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2552 2224 WerFault.exe Q6O.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
SENSIXDPANNEL.exeQ6O.exedescription pid process target process PID 2380 wrote to memory of 2224 2380 SENSIXDPANNEL.exe Q6O.exe PID 2380 wrote to memory of 2224 2380 SENSIXDPANNEL.exe Q6O.exe PID 2380 wrote to memory of 2224 2380 SENSIXDPANNEL.exe Q6O.exe PID 2380 wrote to memory of 2224 2380 SENSIXDPANNEL.exe Q6O.exe PID 2224 wrote to memory of 2552 2224 Q6O.exe WerFault.exe PID 2224 wrote to memory of 2552 2224 Q6O.exe WerFault.exe PID 2224 wrote to memory of 2552 2224 Q6O.exe WerFault.exe PID 2224 wrote to memory of 2552 2224 Q6O.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SENSIXDPANNEL.exe"C:\Users\Admin\AppData\Local\Temp\SENSIXDPANNEL.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Identities\Q6O.exe"C:\Users\Admin\AppData\Roaming\Identities\Q6O.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 6523⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Identities\Q6O.exeFilesize
159KB
MD553eb0bcc17ccf65660a7266e3287ebd6
SHA1c4f2201da904be4882a104d6a291f70aebefb0a6
SHA2567a391340b6677f74bcf896b5cc16a470543e2a384049df47949038df5e770df1
SHA5122c6e157e34721fdc1fb17db73423afbcda9c9c45d61376a220c353a9af73c8aa7237525b4a15d55864762fc07868ab2f71c801a87d0a2cd60cae0fb49c4fbbaa
-
\Users\Admin\AppData\Roaming\Identities\Q6O.exeFilesize
89KB
MD58046876e5ddd312a8db0ee0c2f32a7c2
SHA123cd68da79a408a8e5ea7563aa2b6a1ce3292adc
SHA2566a888025e13e27cad83d36fbefa150c60d1b72ac446679ab0d60c10a5f2fb56a
SHA5126180cd34a5f85d5ed7feb283eab1e24058ca6626eb28331b480d74b6c3a7d59c361a2dd8a87a955bbecf4cba03c7ebc6739b80c9e3d2aaede76df270870e57df
-
\Users\Admin\AppData\Roaming\Identities\Q6O.exeFilesize
84KB
MD57275bc46df8eb2f63511eb21818eb1a2
SHA18df17cbe3bce27d2f03f881f05c4647ef429d4db
SHA25634f96b9591b0f1eace40b64eeebd3cfdb78e28b40fbfb8ad43bcab2be8a89c6e
SHA5123431049c82907427635e2b8ec7fdffc0430b495cfe1896b4e1c74f9720299aca3c4bbdb8dcdaa118c327d1b635029affa5050d7a264fd59ddf89e69b35b3e971
-
memory/2380-0-0x00000000003A0000-0x0000000000412000-memory.dmpFilesize
456KB
-
memory/2380-1-0x0000000074470000-0x0000000074B5E000-memory.dmpFilesize
6.9MB
-
memory/2380-2-0x00000000002E0000-0x0000000000320000-memory.dmpFilesize
256KB
-
memory/2380-14-0x0000000074470000-0x0000000074B5E000-memory.dmpFilesize
6.9MB
-
memory/2380-13-0x0000000000830000-0x000000000086D000-memory.dmpFilesize
244KB
-
memory/2380-11-0x0000000000830000-0x000000000086D000-memory.dmpFilesize
244KB