a9206417bf18fbe241927419daaf2ba6bdec71d4c130256a59ca6f2e8f89cf8e

Resubmissions

03/09/2024, 08:38

240903-kj4klascln 10

03/09/2024, 08:36

240903-kh1gjsscjm 10

03/09/2024, 06:55

240903-hp2l3s1gkh 10

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PenlExecutorV5.exe
Size

21.7MB
MD5

2ab204ea193000dade28d306de97a101
SHA1

b465e38921a355bd93e3224dacbf330665bc69ab
SHA256

a9206417bf18fbe241927419daaf2ba6bdec71d4c130256a59ca6f2e8f89cf8e
SHA512

57a3b37e3f42a33e98b33afc10fdc28bd3247d2ace85772859a63a80fc71676732320e0bda1b6b77565ad8150f6c38ada7800fab76547ec9ced0363ceda1d5dd
SSDEEP

393216:nLct7WGlx0P7z8P/NR5q+5DbqCrqDlJVy2zOeLM+AA+k6zYVz4TUi2I8:ngtpgYP/N/qUDbqgqDjVy2LhhZzEEI

Score

8^/10

defense_evasion discovery evasion execution pyinstaller

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2728	powershell.exe
680	powershell.exe
600	powershell.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 3 IoCs

pid	Process
2836	PenlExecutorV4.exe
1808	PanelExecutorsV8.exe
1240	PanelExecutorsV8.exe

Loads dropped DLL 2 IoCs

pid	Process
1808	PanelExecutorsV8.exe
1240	PanelExecutorsV8.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000a0000000164de-56.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PanelExecutorsV8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PanelExecutorsV8.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2340	powershell.exe
2520	powershell.exe
2728	powershell.exe
680	powershell.exe
600	powershell.exe
2424	powershell.exe
2000	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	2836	PenlExecutorV4.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	600	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2520	3056	PenlExecutorV5.exe	30
PID 3056 wrote to memory of 2520	3056	PenlExecutorV5.exe	30
PID 3056 wrote to memory of 2520	3056	PenlExecutorV5.exe	30
PID 3056 wrote to memory of 2340	3056	PenlExecutorV5.exe	32
PID 3056 wrote to memory of 2340	3056	PenlExecutorV5.exe	32
PID 3056 wrote to memory of 2340	3056	PenlExecutorV5.exe	32
PID 3056 wrote to memory of 2836	3056	PenlExecutorV5.exe	34
PID 3056 wrote to memory of 2836	3056	PenlExecutorV5.exe	34
PID 3056 wrote to memory of 2836	3056	PenlExecutorV5.exe	34
PID 2836 wrote to memory of 2728	2836	PenlExecutorV4.exe	36
PID 2836 wrote to memory of 2728	2836	PenlExecutorV4.exe	36
PID 2836 wrote to memory of 2728	2836	PenlExecutorV4.exe	36
PID 2836 wrote to memory of 680	2836	PenlExecutorV4.exe	38
PID 2836 wrote to memory of 680	2836	PenlExecutorV4.exe	38
PID 2836 wrote to memory of 680	2836	PenlExecutorV4.exe	38
PID 2836 wrote to memory of 600	2836	PenlExecutorV4.exe	40
PID 2836 wrote to memory of 600	2836	PenlExecutorV4.exe	40
PID 2836 wrote to memory of 600	2836	PenlExecutorV4.exe	40
PID 2836 wrote to memory of 1408	2836	PenlExecutorV4.exe	42
PID 2836 wrote to memory of 1408	2836	PenlExecutorV4.exe	42
PID 2836 wrote to memory of 1408	2836	PenlExecutorV4.exe	42
PID 2836 wrote to memory of 2424	2836	PenlExecutorV4.exe	44
PID 2836 wrote to memory of 2424	2836	PenlExecutorV4.exe	44
PID 2836 wrote to memory of 2424	2836	PenlExecutorV4.exe	44
PID 2836 wrote to memory of 2000	2836	PenlExecutorV4.exe	46
PID 2836 wrote to memory of 2000	2836	PenlExecutorV4.exe	46
PID 2836 wrote to memory of 2000	2836	PenlExecutorV4.exe	46
PID 2836 wrote to memory of 1808	2836	PenlExecutorV4.exe	48
PID 2836 wrote to memory of 1808	2836	PenlExecutorV4.exe	48
PID 2836 wrote to memory of 1808	2836	PenlExecutorV4.exe	48
PID 2836 wrote to memory of 1808	2836	PenlExecutorV4.exe	48
PID 1808 wrote to memory of 1240	1808	PanelExecutorsV8.exe	50
PID 1808 wrote to memory of 1240	1808	PanelExecutorsV8.exe	50
PID 1808 wrote to memory of 1240	1808	PanelExecutorsV8.exe	50
PID 1808 wrote to memory of 1240	1808	PanelExecutorsV8.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PenlExecutorV5.exe
"C:\Users\Admin\AppData\Local\Temp\PenlExecutorV5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAegByACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGQAbQBrACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVwBvAHIAawBpAG4AZwAgAGoAdQBzAHQAIABjAGwAaQBjAGsAIABvAGsAJwAsACcAJwAsACcATwBLACcALAAnAEkAbgBmAG8AcgBtAGEAdABpAG8AbgAnACkAPAAjAHcAaQBzACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAZgBpACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAdwBrACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAdABkACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAcgBqACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Users\Admin\AppData\Local\Temp\PenlExecutorV4.exe
  "C:\Users\Admin\AppData\Local\Temp\PenlExecutorV4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'PenlExecutorV4.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\PenlExecutorV4.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\PenlExecutorV4.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:600
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "PenlExecutorV4" /tr "C:\ProgramData\PenlExecutorV4.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAbAB1ACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHcAZgBzACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVwBvAHIAawBpAG4AZwAgAGoAdQBzAHQAIABjAGwAaQBjAGsAIABvAGsAJwAsACcAJwAsACcATwBLACcALAAnAEkAbgBmAG8AcgBtAGEAdABpAG8AbgAnACkAPAAjAGQAeAB5ACMAPgA="
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAcQB2ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGwAawB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGwAZABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGUAYgB5ACMAPgA="
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\PanelExecutorsV8.exe
    "C:\Users\Admin\AppData\Local\Temp\PanelExecutorsV8.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\PanelExecutorsV8.exe
      "C:\Users\Admin\AppData\Local\Temp\PanelExecutorsV8.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PanelExecutorsV8.exe

Filesize
21.6MB

MD5
eeb609c203c96953017ce60c6c837c50

SHA1
cc7d00abeb70ba3c83e4fc169a133cb61794c43c

SHA256
94062fbf362116f6a73b00900baaee497c264f47184d527b7a5026bcef6332c1

SHA512
01ec0c74b166fe71788eec13426b43bf1016eea37656a2b3cfd8e57e25a19d3efb585d7481857fbd7eccfe31bbad3087bc7b2bfffc97d52b94b9c666237bf425

Download Submit
C:\Users\Admin\AppData\Local\Temp\PenlExecutorV4.exe

Filesize
21.6MB

MD5
41a303702620b554aa697cadcd937f80

SHA1
861eb3f46b826678d2dea7710413a4973bf664ec

SHA256
ed3ddc8dd5074454b681f10cc1ba5deb82fe8fe981cede1465bbbf1818052960

SHA512
92d22aafa18c0738d64a0fa3ab9fd964bec4447a093983cf0ed4de89a8dcf6d29f2e7e6e36c9a1bf4b52d2cb435548a5629f5eb3b4615a4e51c0dac173cf7ef7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18082\python39.dll

Filesize
4.2MB

MD5
2a9c5db70c6906571f2ca3a07521baa2

SHA1
765fa27bbee6a02b20b14b2b78c92a880e6627e5

SHA256
c69ce89b0487d86a63b64951207781f8051282afde67b20d3b8374c1a067f611

SHA512
fa4a677eaae2d258ac4f083a4e7009d985523b964ada93f53dc399a88c14970c7be2d2f39a7b38a922b58d134df2ede954554dcd00a4895e4273161867acac53

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18082\wheel-0.43.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
73dbeb8b0b412443695e7535c7d10ea8

SHA1
3ab43274c972c93a119ee0b8a111f5334a64689c

SHA256
6a07f607cd9b6a3c1c4b364c74536d8ec796df36002dee77838c5d63ce628e69

SHA512
17251b31bd2dd42accc7fe161523ef16c3d9ea8b818da0f1e6b13a13be00b001357ff0149a7d6655df60d28a4b8ed6bea65fe03b7e5fa6dcfe07a63a275c4ba7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b83f8341f2872fda3097e36f5390304b

SHA1
5d40e7ee2ef603a88275f52c13f62b43bb35f441

SHA256
4c0891dd3867034c64dad602f219c7ef756d16aab5adaac6786c5254991c3d07

SHA512
c42722aa2558497f851d48a6c249dd0d09aee1e059c2e90eb47eaefecd6a1c0b81a173b1d3dffc313f104d987a09d982c1f7df3f47adfa015bd4a1c7b582f05c

Download Submit
memory/2520-12-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2520-13-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2728-26-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2728-27-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2836-20-0x0000000000020000-0x00000000015CA000-memory.dmp

Filesize
21.7MB

Download
memory/2836-40-0x000000001DE60000-0x000000001F404000-memory.dmp

Filesize
21.6MB

Download
memory/3056-0-0x000007FEF58B3000-0x000007FEF58B4000-memory.dmp

Filesize
4KB

Download
memory/3056-19-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp

Filesize
9.9MB

Download
memory/3056-2-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp

Filesize
9.9MB

Download
memory/3056-1-0x0000000000120000-0x00000000016CE000-memory.dmp

Filesize
21.7MB

Download