Overview

overview

10

Static

static

3

337f603c8b...18.exe

windows7-x64

10

337f603c8b...18.exe

windows10-2004-x64

10

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$TEMP/setup.exe

windows7-x64

10

$TEMP/setup.exe

windows10-2004-x64

10

$TEMP/sys.exe

windows7-x64

7

$TEMP/sys.exe

windows10-2004-x64

7

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

3

$PLUGINSDI...es.dll

windows7-x64

3

$PLUGINSDI...es.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$R1.dll

windows7-x64

6

$R1.dll

windows10-2004-x64

6

$TEMP/tcpsrvc.exe

windows7-x64

7

$TEMP/tcpsrvc.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$SYSDIR/$S...1_.exe

windows7-x64

7

$SYSDIR/$S...1_.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$SYSDIR/$_5_.dll

windows7-x64

6

$SYSDIR/$_5_.dll

windows10-2004-x64

6

Analysis

  • max time kernel
    146s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2024 05:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $TEMP/setup.exe

  • Size

    2.4MB

  • MD5

    b774d568aaf090164ec32291370cb341

  • SHA1

    f5a55bcd898ff2848df1bb067e5012951dfbc266

  • SHA256

    56e96195f7c806eb74503977eb61fd681b99ac14fcdb9f852d89ee46b0edc5ef

  • SHA512

    0ffe18d77b13e5a94be4575984982d4d583450821865821be9c7dcffcb2fb03a744b4ca530516ba8917eb2d130bf8767416259563ecefe511ccbf34254f52691

  • SSDEEP

    49152:QT1/JEQtPdZoRTrfDgHGRvrDZg5aa1ChFpqKiv+9:QTRtfoNDvlZ8aa1CMKx

Score
10/10
pandastealerdiscoverystealer

Malware Config

Signatures

  • Panda Stealer payload 2 IoCs
  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\setup.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Users\Admin\AppData\Local\Temp\7zSAC6C.tmp\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSAC6C.tmp\setup.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2428
      • C:\Windows\SysWOW64\msiexec.exe
        "msiexec" /i "C:\Program Files (x86)\Downloaded Installers\{240D57C0-234A-4CAD-B6E7-DFDE6B0B1272}\setup.msi"
        3⤵
        • Blocklisted process makes network request
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:5092
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1304
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 59F1A3BDCA07B429EBB0EEC4BD3FD7A9 C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:368
        • C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe
          "C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe"
          3⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:4432
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3440

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e583da1.rbs
      Filesize

      8KB

      MD5

      135cfce276eac0da591b1c3f6b8ed731

      SHA1

      1cba497ed2ed21d74dc953f3924e639a52f7fd9e

      SHA256

      1fd2bcc1dccd514b6d71640735a012a9f9e877b063cc10d5061cb371c6b74f0c

      SHA512

      5e952b407fe429460c63c20ab9a7a137c26d8d413e6e5e5008c071408994860cbc10533e8cd72163d2e841b7cca7bbee50d4ca5c1d69b9ba8e60c88aa02598be

      Download Submit

    • C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe
      Filesize

      22.5MB

      MD5

      1698d9ac0c1167d6cf7b8a32ebff81b3

      SHA1

      31241974219fcba442fe61937df9a891fcf829ac

      SHA256

      796ca26fc493a66153fc1129acc989bddef7fccf7ca3cbfac409088be8437378

      SHA512

      40e416467ac416c87efd8e7876a86c9f618684ddd0b107108345d7ac67c0db7ed72f395844ac1dc8f5039683593015bf61ab84bf5ba5f22797d8419aacb9e16f

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
      Filesize

      75KB

      MD5

      84fb59541357ebbac17a5dd906b3957e

      SHA1

      ef72d52c513b97a066a4922609862559645a6f7a

      SHA256

      44e527b61336921190fca1222af6ced398b67b36a7803c05525eb5dc9a18a93a

      SHA512

      8547ae3ebcf38b9c46b18ad0264222a93520bf55fd2fbbcbe757b61b5fd18d209817dae5dc432f12c65fae6be769da6f71c1b24afe03ef473854e1b00baeec01

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_0AEA4C6D6CCC81E7AABA17FA25994227
      Filesize

      5B

      MD5

      5bfa51f3a417b98e7443eca90fc94703

      SHA1

      8c015d80b8a23f780bdd215dc842b0f5551f63bd

      SHA256

      bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

      SHA512

      4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
      Filesize

      212B

      MD5

      b169461f3e15c925d68c20944422b2a9

      SHA1

      261ba7c06ae4cb15527333b6ada2e82aed68df3d

      SHA256

      4ab611635e17db883b686bde73f855d8ac00d18ef8033e60ab20e7ca7826bc2f

      SHA512

      69f2f4ee9291e5df1b56215865ebbac76f145a28eb11e7dc941d3baefd063cf8511e794ad0fbb746cc12d9a21daf377482f346bda61e213f06727108a0acee19

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_0AEA4C6D6CCC81E7AABA17FA25994227
      Filesize

      404B

      MD5

      333636fce121c2978a5739021e2b797c

      SHA1

      7ab76a22da00e8c26e0e4d0d4edb89e05fe07b2c

      SHA256

      650c0c900ae1e27caec55b7ac569189a60751bd65ca81c2c7c262cb101afbf46

      SHA512

      3483b4e4b63b29cdeefa455e27ee69149d2d23b67c10c7072bc66cfb452e7dc70c55bf7f6e984f97379bb5ff911c81f09d3af6ed52fcd7565978754dea3f3793

      Download Submit

    • C:\Users\Admin\AppData\Local\SlimWare Utilities Inc\SlimDrivers\SWDUMon.sys
      Filesize

      15KB

      MD5

      a3a548c9b02b9cb91721da152bc34f04

      SHA1

      147daf95f1417a9f2ba6e6cea47c631a0b5992f1

      SHA256

      944cf2dd7c284d006dc87c3768bbace5469f8f6d8b3e1df7fbf3e751b7583451

      SHA512

      54e0742685862c39b989319d1858f965011073b8998b72bb5e08573c51b6d486e77ee4354110089a9e20929f517441bc1b26e2cd4eb934cffb306d5d007a31fb

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zSAC6C.tmp\setup.exe
      Filesize

      73KB

      MD5

      ca6be57a4f75e216f320f97ae1098ff6

      SHA1

      3d8824b17c5a4c4afb887182a9af68c981b4b859

      SHA256

      7061f18bc963a9452432458cbffba4607ab55c360cfda38dda2fb913adb7a3ed

      SHA512

      8ff5f86a03d70bbe5cc34c0ce3586d49edccf557ed3f6565cebd07fb9218cb6ebf80f536f93ea0401373e309127bfe9dea83f66325623a5bc66ce677be886804

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zSAC6C.tmp\setup.msi
      Filesize

      23.6MB

      MD5

      66105820fc90d4728885dc0a497b8213

      SHA1

      4575ee17d6c1ee5ff114ca1be6b5ae547d6df965

      SHA256

      eb34cd95f9da684b1d680bc5d7d710fbd14318d341711a9e53b43578ad7d9310

      SHA512

      a865fa5fb01509ca9a18d51f4d173b4fbf6ee61c8cb1a13ccde2bb99f134085355325240a598eec5c9bb5138ba8c00ad577a17611ae9d0844baa34e74aaa72d3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSI5426.tmp
      Filesize

      148KB

      MD5

      14c01c848d8452005734858a64b6784b

      SHA1

      d3d81fcd1267095880218ef09b92220248905ea8

      SHA256

      fa9b83479f1b955790325dc557624185a8c72df3e31870dae075437146858185

      SHA512

      8334c467c470c13b0245425d3bc1ba9676a04e1e015bec56122504d622e7e3858d5ad7950d09c155f3666a90b7d3c7b40f324d0786553d6e81711b7f38cf1d57

      Download Submit

    • C:\Windows\Tasks\SlimDrivers Startup.job
      Filesize

      428B

      MD5

      fdf88ca705e1a899d4a91fe6c8e40599

      SHA1

      35f04651a8fd95aadeca1e5f48102f29cac860c1

      SHA256

      1e723a7c5326ea52789477010a62e2fc03db75d72a1490c1045f34190c93b39a

      SHA512

      8d0312c5f47b0c11e3c9396e2f66bb344fe316286513a7f262f023d0958686a3340667d68d656d4a1dc2d3f5d60dcfb50953b2833253b67f1088a34648323000

      Download Submit

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      Filesize

      24.1MB

      MD5

      364b06f01f3a03aaf0de948ceabb8d23

      SHA1

      5d9950869504d54cf35007b0f8ef2c5f7e3200e0

      SHA256

      3da1696ade8014954e36afe3ea95882e3038c2a15f5d2f41c60e5cf1fd6b60c1

      SHA512

      74fdc2015335a44b3dc4e1f176d9deb178b0f8c77541bcfb765825b3372b94ae9a16a738332029a03beae647a8279a225fed1346b28eafc311efee29f57fdc27

      Download Submit

    • \??\Volume{77a2731a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{729122ff-2dbe-4599-b174-1de76be55a9b}_OnDiskSnapshotProp
      Filesize

      6KB

      MD5

      1deea66b68b0a009d1956648d9baa5f3

      SHA1

      8db166965e6769eccc83da411f0faed319d7f287

      SHA256

      a56a721e6d930f989c0581b1ee255f2f3a5eb9df0b408e119d7ad2598ebfd344

      SHA512

      1a694db2042c600525941f72ccd8bdff0b87e8c3a02d449a6c776aee33fc98f8cc44150ed873781dae7ed2dd440a85348848233b469d6b9261dcadd011d47b7b

      Download Submit