Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 01:41
Behavioral task
behavioral1
Sample
03f7e21506f089d657a6c04c55902976.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
03f7e21506f089d657a6c04c55902976.exe
Resource
win10v2004-20240611-en
General
-
Target
03f7e21506f089d657a6c04c55902976.exe
-
Size
5.7MB
-
MD5
03f7e21506f089d657a6c04c55902976
-
SHA1
dda208c6619d4e43107666bc6f8a5f84b6cb768a
-
SHA256
8a644dfd2abc6310fc90f7e6908c373190a956544a4fd15de05fc5974704e7d5
-
SHA512
edd93821c820d545610fd1fe5703bbbc4b908b18f2d6020d4e12926207928c4fc99c69c7ec797a745f7bcabff31c2d7b9df1cc50627d5f4fa2a28f9c7f2c82de
-
SSDEEP
98304:qMbTbHYM2WwqOJ4V9PTs8yuCtJ9IL6VkS8nNSlR/W/2l/zAbPppEiPu3mz7:l/HYVtqOJqTsVvXILUkS8NSlR+KsnExw
Malware Config
Signatures
-
Panda Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2084-11-0x0000000000CE0000-0x0000000001644000-memory.dmp family_pandastealer behavioral1/memory/2084-14-0x0000000000CE0000-0x0000000001644000-memory.dmp family_pandastealer behavioral1/memory/2084-15-0x0000000000CE0000-0x0000000001644000-memory.dmp family_pandastealer behavioral1/memory/2084-35-0x0000000000CE0000-0x0000000001644000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2084-11-0x0000000000CE0000-0x0000000001644000-memory.dmp shurk_stealer behavioral1/memory/2084-14-0x0000000000CE0000-0x0000000001644000-memory.dmp shurk_stealer behavioral1/memory/2084-15-0x0000000000CE0000-0x0000000001644000-memory.dmp shurk_stealer behavioral1/memory/2084-35-0x0000000000CE0000-0x0000000001644000-memory.dmp shurk_stealer -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2084-11-0x0000000000CE0000-0x0000000001644000-memory.dmp vmprotect behavioral1/memory/2084-14-0x0000000000CE0000-0x0000000001644000-memory.dmp vmprotect behavioral1/memory/2084-15-0x0000000000CE0000-0x0000000001644000-memory.dmp vmprotect behavioral1/memory/2084-35-0x0000000000CE0000-0x0000000001644000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
03f7e21506f089d657a6c04c55902976.exepid process 2084 03f7e21506f089d657a6c04c55902976.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
03f7e21506f089d657a6c04c55902976.exepid process 2084 03f7e21506f089d657a6c04c55902976.exe 2084 03f7e21506f089d657a6c04c55902976.exe