Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26-03-2024 13:42
General
-
Target
df4e68852040ee5abdd047c8d358bcfd.exe
-
Size
5.8MB
-
MD5
df4e68852040ee5abdd047c8d358bcfd
-
SHA1
b2d077578e9d4326b47d5b2002ea447209e4f32f
-
SHA256
3c4747711e6ea57f84af33e1676740a0a25f899283ee994cf23fe3aaf55aed59
-
SHA512
53c888abb92207efe8590b0d7fb790d04681da466bb8d8a0b24548213f3c69d3487f42a4cbcb4eed2ce53b14644af1f6b713a3ea5dff9d05f8cac835ea802b0d
-
SSDEEP
98304:6E2+izM+YzKruSagC+R3ov+mukYBoGrQV8cMiK8YV6r8ZFDrk0uS:6EjizM+YzKZaioG///4xE8/r8ZFD4pS
Score
10/10
Malware Config
Extracted
Family
pandastealer
Version
1.11
C2
http://f0565988.xsph.ru
Signatures
-
Panda Stealer payload 4 IoCs
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df4e68852040ee5abdd047c8d358bcfd.exe"C:\Users\Admin\AppData\Local\Temp\df4e68852040ee5abdd047c8d358bcfd.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.8MB
-
Filesize
9.8MB