c1ce85233af641b7c1cf831a3d95639bf439caa72386d01ad77797e0317e1d2d

Resubmissions

24-08-2024 21:20

240824-z61jsazfne 7

24-08-2024 21:16

240824-z4evaszeje 7

Analysis

max time kernel
135s
max time network
148s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Pterodactyl Desktop.exe
Size

129.8MB
MD5

8d31a6ec3edf1f6bc88df0506368d63d
SHA1

b9b924b1291e822723fffc98cb05d0710b7641cd
SHA256

6c451ed78396efe6e4e1b0d997b82a7db2d3de81d6a26b51b43ec37f4088862c
SHA512

5e3b2597fb0093b0de4e3d64c7024310c2b5a05ebaa7b07fbe9f7a6283decb978183c6554c4f8352c19e967f416e4f4feb23ecd630098de7ee9a655f498cbf0c
SSDEEP

1572864:omYWQRWtJ65M7a2iu4Rywh9hJyO9N+oJOTU8f/kmgZ2sI:f4M7a2H4Ryu+dNgI

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Control Panel\International\Geo\Nation	Pterodactyl Desktop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Control Panel\International\Geo\Nation	Pterodactyl Desktop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Control Panel\International\Geo\Nation	Pterodactyl Desktop.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Pterodactyl Desktop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Pterodactyl Desktop.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2736	Pterodactyl Desktop.exe
2728	Pterodactyl Desktop.exe
2084	Pterodactyl Desktop.exe
2084	Pterodactyl Desktop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 1900	2084	Pterodactyl Desktop.exe	31
PID 2084 wrote to memory of 2736	2084	Pterodactyl Desktop.exe	32
PID 2084 wrote to memory of 2736	2084	Pterodactyl Desktop.exe	32
PID 2084 wrote to memory of 2736	2084	Pterodactyl Desktop.exe	32
PID 2084 wrote to memory of 2728	2084	Pterodactyl Desktop.exe	33
PID 2084 wrote to memory of 2728	2084	Pterodactyl Desktop.exe	33
PID 2084 wrote to memory of 2728	2084	Pterodactyl Desktop.exe	33
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34
PID 2084 wrote to memory of 2348	2084	Pterodactyl Desktop.exe	34

C:\Users\Admin\AppData\Local\Temp\Pterodactyl Desktop.exe
"C:\Users\Admin\AppData\Local\Temp\Pterodactyl Desktop.exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\Pterodactyl Desktop.exe
  "C:\Users\Admin\AppData\Local\Temp\Pterodactyl Desktop.exe" --type=gpu-process --field-trial-handle=952,9569640177063712249,15463694487363320722,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=964 /prefetch:2
  2⤵
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\Pterodactyl Desktop.exe
  "C:\Users\Admin\AppData\Local\Temp\Pterodactyl Desktop.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=952,9569640177063712249,15463694487363320722,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736
- C:\Users\Admin\AppData\Local\Temp\Pterodactyl Desktop.exe
  "C:\Users\Admin\AppData\Local\Temp\Pterodactyl Desktop.exe" --type=renderer --field-trial-handle=952,9569640177063712249,15463694487363320722,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1456 /prefetch:1
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- C:\Users\Admin\AppData\Local\Temp\Pterodactyl Desktop.exe
  "C:\Users\Admin\AppData\Local\Temp\Pterodactyl Desktop.exe" --type=gpu-process --field-trial-handle=952,9569640177063712249,15463694487363320722,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=964 /prefetch:2
  2⤵
  PID:2348
- C:\Users\Admin\AppData\Local\Temp\Pterodactyl Desktop.exe
  "C:\Users\Admin\AppData\Local\Temp\Pterodactyl Desktop.exe" --type=renderer --field-trial-handle=952,9569640177063712249,15463694487363320722,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1604 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\pterodactyl-desktop\Cache\f_000006

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Roaming\pterodactyl-desktop\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
00e10e5efaecb4e8352c726d44e47d69

SHA1
bb8ac00e5a6a7428d9b6b436502aae2b4dc52700

SHA256
a9c36d1022c1778638b7c7f530ef04903278edc480480f79b3500e10fb72dda6

SHA512
8f7eef5a7eeba03c8b332b20e51c2eb06badcf68e873c3871c05f05086a94e770d9e1dc42e349e007976521441c9d71bc1e8f025605514e46eb1d18346d9802e

Download Submit
C:\Users\Admin\AppData\Roaming\pterodactyl-desktop\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
memory/1900-33-0x00000000773D0000-0x00000000773D1000-memory.dmp

Filesize
4KB

Download
memory/1900-1-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download