Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16-03-2024 19:43
Static task
static1
Behavioral task
behavioral1
Sample
cee69c3ff3b220085300c521b466dff0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cee69c3ff3b220085300c521b466dff0.exe
Resource
win10v2004-20240226-en
General
-
Target
cee69c3ff3b220085300c521b466dff0.exe
-
Size
820KB
-
MD5
cee69c3ff3b220085300c521b466dff0
-
SHA1
9e7380e3b8a303220431cbb94df43176d3ad7dd0
-
SHA256
8ce12f5cdcba1d7ae07442bd0ccd77590037dca26eb7db1d08b7a4608b832586
-
SHA512
9c11cb65c03c275f15a2614d271c3f4220de8c4a4b7df9990b7922bcfe6c98af59653f489542a83783fe6d65e44a2c8172c0fbcaa1884d81c73079a4cedd3200
-
SSDEEP
12288:1U+kd3PrGG9CdDrV4+JEDW5z0u4BowvLC6UpL6aQHYUyWtnV:kiG9CdDrVzf4JBPCThQ4UyWtnV
Malware Config
Signatures
-
Panda Stealer payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1356-7-0x0000000000400000-0x000000000047A000-memory.dmp family_pandastealer behavioral2/memory/1356-9-0x0000000000400000-0x000000000047A000-memory.dmp family_pandastealer behavioral2/memory/1356-10-0x0000000000400000-0x000000000047A000-memory.dmp family_pandastealer behavioral2/memory/1356-12-0x0000000000400000-0x000000000047A000-memory.dmp family_pandastealer behavioral2/memory/1356-36-0x0000000000400000-0x000000000047A000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1356-7-0x0000000000400000-0x000000000047A000-memory.dmp shurk_stealer behavioral2/memory/1356-9-0x0000000000400000-0x000000000047A000-memory.dmp shurk_stealer behavioral2/memory/1356-10-0x0000000000400000-0x000000000047A000-memory.dmp shurk_stealer behavioral2/memory/1356-12-0x0000000000400000-0x000000000047A000-memory.dmp shurk_stealer behavioral2/memory/1356-36-0x0000000000400000-0x000000000047A000-memory.dmp shurk_stealer -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
cee69c3ff3b220085300c521b466dff0.exedescription pid process target process PID 2456 set thread context of 1356 2456 cee69c3ff3b220085300c521b466dff0.exe cee69c3ff3b220085300c521b466dff0.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
cee69c3ff3b220085300c521b466dff0.exepid process 1356 cee69c3ff3b220085300c521b466dff0.exe 1356 cee69c3ff3b220085300c521b466dff0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cee69c3ff3b220085300c521b466dff0.exedescription pid process Token: SeDebugPrivilege 2456 cee69c3ff3b220085300c521b466dff0.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
cee69c3ff3b220085300c521b466dff0.exedescription pid process target process PID 2456 wrote to memory of 1356 2456 cee69c3ff3b220085300c521b466dff0.exe cee69c3ff3b220085300c521b466dff0.exe PID 2456 wrote to memory of 1356 2456 cee69c3ff3b220085300c521b466dff0.exe cee69c3ff3b220085300c521b466dff0.exe PID 2456 wrote to memory of 1356 2456 cee69c3ff3b220085300c521b466dff0.exe cee69c3ff3b220085300c521b466dff0.exe PID 2456 wrote to memory of 1356 2456 cee69c3ff3b220085300c521b466dff0.exe cee69c3ff3b220085300c521b466dff0.exe PID 2456 wrote to memory of 1356 2456 cee69c3ff3b220085300c521b466dff0.exe cee69c3ff3b220085300c521b466dff0.exe PID 2456 wrote to memory of 1356 2456 cee69c3ff3b220085300c521b466dff0.exe cee69c3ff3b220085300c521b466dff0.exe PID 2456 wrote to memory of 1356 2456 cee69c3ff3b220085300c521b466dff0.exe cee69c3ff3b220085300c521b466dff0.exe PID 2456 wrote to memory of 1356 2456 cee69c3ff3b220085300c521b466dff0.exe cee69c3ff3b220085300c521b466dff0.exe PID 2456 wrote to memory of 1356 2456 cee69c3ff3b220085300c521b466dff0.exe cee69c3ff3b220085300c521b466dff0.exe PID 2456 wrote to memory of 1356 2456 cee69c3ff3b220085300c521b466dff0.exe cee69c3ff3b220085300c521b466dff0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cee69c3ff3b220085300c521b466dff0.exe"C:\Users\Admin\AppData\Local\Temp\cee69c3ff3b220085300c521b466dff0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cee69c3ff3b220085300c521b466dff0.exeC:\Users\Admin\AppData\Local\Temp\cee69c3ff3b220085300c521b466dff0.exe2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1356-7-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1356-36-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1356-12-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1356-10-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1356-9-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2456-6-0x0000000004D30000-0x0000000004D4E000-memory.dmpFilesize
120KB
-
memory/2456-0-0x0000000000360000-0x0000000000430000-memory.dmpFilesize
832KB
-
memory/2456-5-0x0000000004E30000-0x0000000004EA6000-memory.dmpFilesize
472KB
-
memory/2456-4-0x0000000004CE0000-0x0000000004D00000-memory.dmpFilesize
128KB
-
memory/2456-11-0x0000000075210000-0x00000000759C0000-memory.dmpFilesize
7.7MB
-
memory/2456-3-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/2456-2-0x0000000004D70000-0x0000000004D80000-memory.dmpFilesize
64KB
-
memory/2456-1-0x0000000075210000-0x00000000759C0000-memory.dmpFilesize
7.7MB