Analysis
-
max time kernel
177s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31-12-2023 09:22
General
-
Target
30b02e598cbe1894d3c40a86dfdc5e68.exe
-
Size
2.9MB
-
MD5
30b02e598cbe1894d3c40a86dfdc5e68
-
SHA1
1193e7e46c1930330679717589d074b3317ac587
-
SHA256
1f94bf7cb3397c4f28553728271df220d9d75c3e7d03c6f38a7aa5b79c054cd1
-
SHA512
1cfb99240657563adf0801e79f3fd1a88063a28f94782502a4b8ac8fe5019f7ed99413dcc915dceaeea391b3fb8105498a767aff3b394a8ebbefe87180ede7ac
-
SSDEEP
49152:NO38h57b5LGKwboJ3IvVYPHBdNGG6G551TsrFXPtYUJUYFU9y/7VPcJYTsptDHT2:Ca5FGZcWYPHBdcG6GD1TsRx4U75e2stu
Malware Config
Extracted
pandastealer
1.11
http://f0562538.xsph.ru
Signatures
-
Panda Stealer payload 11 IoCs
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 13 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\30b02e598cbe1894d3c40a86dfdc5e68.exe"C:\Users\Admin\AppData\Local\Temp\30b02e598cbe1894d3c40a86dfdc5e68.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.4MB
-
Filesize
8KB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB