Overview

overview

10

Static

static

3

a3dd5e28b1...36.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    48s
  • max time network
    53s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241023-en
  • resource tags

    arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11/02/2025, 13:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a3dd5e28b1b551cbb99219d143efe1e888180cb6d7e20e22b78172e17e046336.exe

  • Size

    1.4MB

  • MD5

    5b17a03a0b5c94c375c32700f075bb02

  • SHA1

    64aa47ddef5c2cd0969010ce4a5f01316f28a13b

  • SHA256

    a3dd5e28b1b551cbb99219d143efe1e888180cb6d7e20e22b78172e17e046336

  • SHA512

    0ba5e0bc997d0f44fab6bf9c8ba46e56992c56aa4e5fe1f4aed4420f958f26c684341d46ca0000bab3cc7141b232a163e6a309268945149a3d9f7417d50cf96c

  • SSDEEP

    24576:r6ys9o58JgbCBySG0qJb/E3x+1+QbataqDJmxFDSkAjZoxCSIKRQ+H5ADZUznX81:u996bRSgJgEbxq9mxxFuBeRJZADZUzs3

Score
10/10
pandastealercredential_accessdiscoveryspywarestealer

Malware Config

Signatures

  • Panda Stealer payload 1 IoCs
  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer
  • Pandastealer family
    pandastealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3dd5e28b1b551cbb99219d143efe1e888180cb6d7e20e22b78172e17e046336.exe
    "C:\Users\Admin\AppData\Local\Temp\a3dd5e28b1b551cbb99219d143efe1e888180cb6d7e20e22b78172e17e046336.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1788
  • C:\Windows\system32\control.exe
    "C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3256
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1232
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3412
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2340
  • C:\Windows\system32\BackgroundTransferHost.exe
    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
    1⤵
    • Modifies registry class
    PID:1104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
    Filesize

    14KB

    MD5

    20819d7fcf1fa4119b6f17c7f8f500d8

    SHA1

    6531ce9c140a4632bddcc18376fe5d2e17f58448

    SHA256

    4513bdae059d359a375852f7aef4c40a0848d41e47027e1484472d162073e45a

    SHA512

    db8b825afba38bf83c216fde9f64989f9bd336d48d26e994bf11e386b3962f8b44f3ecb5b75a0a40e3868518819cd58c1e6ce63e89ebfd243b15f4cb366a1914

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\77997d39-1456-4d61-b365-85f8322fcd1c.down_data
    Filesize

    555KB

    MD5

    5683c0028832cae4ef93ca39c8ac5029

    SHA1

    248755e4e1db552e0b6f8651b04ca6d1b31a86fb

    SHA256

    855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

    SHA512

    aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

    Download Submit

  • memory/1788-0-0x0000000000C70000-0x0000000001064000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/1788-1-0x0000000000C70000-0x0000000001064000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/1788-2-0x0000000000F7D000-0x0000000001064000-memory.dmp

    Filesize

    924KB

    Download

  • memory/1788-21-0x0000000000C70000-0x0000000001064000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/2340-31-0x000001FA9FF50000-0x000001FA9FF51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2340-32-0x000001FA9FF50000-0x000001FA9FF51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2340-33-0x000001FA9FF50000-0x000001FA9FF51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2340-40-0x000001FA9FF50000-0x000001FA9FF51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2340-43-0x000001FA9FF50000-0x000001FA9FF51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2340-42-0x000001FA9FF50000-0x000001FA9FF51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2340-41-0x000001FA9FF50000-0x000001FA9FF51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2340-39-0x000001FA9FF50000-0x000001FA9FF51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2340-38-0x000001FA9FF50000-0x000001FA9FF51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2340-37-0x000001FA9FF50000-0x000001FA9FF51000-memory.dmp

    Filesize

    4KB

    Download