Analysis
-
max time kernel
120s -
max time network
116s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-07-2024 08:00
Static task
static1
Behavioral task
behavioral1
Sample
Panel/Panel.exe
Resource
win11-20240709-en
Behavioral task
behavioral2
Sample
builder/RedlineBuilder.exe
Resource
win11-20240709-en
Behavioral task
behavioral3
Sample
builder/builder.bat
Resource
win11-20240709-en
General
-
Target
Panel/Panel.exe
-
Size
1.7MB
-
MD5
29c3965e2f5893bd7905ca589cae3188
-
SHA1
1276122036cfd994e323621dfe9d3b3e588d149d
-
SHA256
c49b8186447154807bad77030cfbde76fd9a6053616537e4c31ed78fbcf2d7d6
-
SHA512
268d894ceabf6366d2197b4a2f9c83b05a7afe322508eab08bdd737fa13caf0daaea537075cc4709aade634847f24135cfd290a172bce9259dd8fee6b2d6afa3
-
SSDEEP
12288:jLxeIKOsGPgbym1AYdjXpXpXpXpXpXpXEX0XjlC07Ms4HRdt4umBNOu/XpXpXpXw:jLRKOJlYd5B7MsW2ijf96EB2VgmvvWR
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Panel.exePanel.exepid process 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 1840 Panel.exe 2236 Panel.exe 2236 Panel.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Panel.exePanel.exedescription pid process Token: SeDebugPrivilege 2236 Panel.exe Token: SeDebugPrivilege 1840 Panel.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Panel.exedescription pid process target process PID 2236 wrote to memory of 1840 2236 Panel.exe Panel.exe PID 2236 wrote to memory of 1840 2236 Panel.exe Panel.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Panel\Panel.exe"C:\Users\Admin\AppData\Local\Temp\Panel\Panel.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Panel\Panel.exe"C:\Users\Admin\AppData\Local\Temp\Panel\Panel.exe" "--monitor"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1840-10-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmpFilesize
10.8MB
-
memory/1840-19-0x0000021243B30000-0x0000021243B6C000-memory.dmpFilesize
240KB
-
memory/1840-11-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmpFilesize
10.8MB
-
memory/1840-3-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmpFilesize
10.8MB
-
memory/1840-4-0x0000021227420000-0x000002122745A000-memory.dmpFilesize
232KB
-
memory/1840-5-0x000002123FE70000-0x000002123FF20000-memory.dmpFilesize
704KB
-
memory/1840-6-0x000002123FB40000-0x000002123FB62000-memory.dmpFilesize
136KB
-
memory/1840-7-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmpFilesize
10.8MB
-
memory/1840-12-0x0000021243A60000-0x0000021243AAA000-memory.dmpFilesize
296KB
-
memory/1840-9-0x00000212400C0000-0x0000021240134000-memory.dmpFilesize
464KB
-
memory/1840-27-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmpFilesize
10.8MB
-
memory/1840-26-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmpFilesize
10.8MB
-
memory/1840-8-0x0000021225B20000-0x0000021225B32000-memory.dmpFilesize
72KB
-
memory/1840-13-0x0000021243A30000-0x0000021243A48000-memory.dmpFilesize
96KB
-
memory/1840-14-0x000002123FFB0000-0x000002123FFC0000-memory.dmpFilesize
64KB
-
memory/1840-18-0x0000021243AD0000-0x0000021243AE2000-memory.dmpFilesize
72KB
-
memory/1840-25-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmpFilesize
10.8MB
-
memory/1840-21-0x0000021243AC0000-0x0000021243AD0000-memory.dmpFilesize
64KB
-
memory/2236-24-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmpFilesize
10.8MB
-
memory/2236-1-0x0000015F66500000-0x0000015F666B0000-memory.dmpFilesize
1.7MB
-
memory/2236-2-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmpFilesize
10.8MB
-
memory/2236-0-0x00007FFD0E863000-0x00007FFD0E865000-memory.dmpFilesize
8KB