Analysis
-
max time kernel
120s -
max time network
116s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-07-2024 08:00
Static task
static1
Behavioral task
behavioral1
Sample
Panel/Panel.exe
Resource
win11-20240709-en
Behavioral task
behavioral2
Sample
builder/RedlineBuilder.exe
Resource
win11-20240709-en
Behavioral task
behavioral3
Sample
builder/builder.bat
Resource
win11-20240709-en
General
-
Target
Panel/Panel.exe
-
Size
1.7MB
-
MD5
29c3965e2f5893bd7905ca589cae3188
-
SHA1
1276122036cfd994e323621dfe9d3b3e588d149d
-
SHA256
c49b8186447154807bad77030cfbde76fd9a6053616537e4c31ed78fbcf2d7d6
-
SHA512
268d894ceabf6366d2197b4a2f9c83b05a7afe322508eab08bdd737fa13caf0daaea537075cc4709aade634847f24135cfd290a172bce9259dd8fee6b2d6afa3
-
SSDEEP
12288:jLxeIKOsGPgbym1AYdjXpXpXpXpXpXpXEX0XjlC07Ms4HRdt4umBNOu/XpXpXpXw:jLRKOJlYd5B7MsW2ijf96EB2VgmvvWR
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 2236 Panel.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2236 Panel.exe Token: SeDebugPrivilege 1840 Panel.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1840 2236 Panel.exe 83 PID 2236 wrote to memory of 1840 2236 Panel.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\Panel\Panel.exe"C:\Users\Admin\AppData\Local\Temp\Panel\Panel.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\Panel\Panel.exe"C:\Users\Admin\AppData\Local\Temp\Panel\Panel.exe" "--monitor"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840
-