283663ea0f593bc5a4096da2a0a5effc0fd87003ad0d9f7aa0549c0be0647168

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/03/2025, 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-11_24250744c142cfd910615124bd110528_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe
Size

17.7MB
MD5

24250744c142cfd910615124bd110528
SHA1

c9f98decb8fe2d823ad9ba467cc072c27121dc60
SHA256

283663ea0f593bc5a4096da2a0a5effc0fd87003ad0d9f7aa0549c0be0647168
SHA512

84045cbb66b7ba3fe025767708adbe486ddffd7cd5c92509b09f7dfb8a035f8e2fa3f4e03c6e0cb16824b55ba9a9f0f6732d142c8ae08fc170ccec28f4704054
SSDEEP

98304:WfQTmnB+MhVgMJDE11ODVEEMs9K1NU+nusEnsnK5vrCwm:WfQu+egMJY1OMs9K1NU+nKnxVNm

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2456	cPandaVPN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cPandaVPN.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2456	cPandaVPN.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
624	powershell.exe
2456	cPandaVPN.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	powershell.exe
Token: SeDebugPrivilege	2456	cPandaVPN.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 540	2528	2025-03-11_24250744c142cfd910615124bd110528_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe	31
PID 2528 wrote to memory of 540	2528	2025-03-11_24250744c142cfd910615124bd110528_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe	31
PID 2528 wrote to memory of 540	2528	2025-03-11_24250744c142cfd910615124bd110528_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe	31
PID 2528 wrote to memory of 624	2528	2025-03-11_24250744c142cfd910615124bd110528_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe	32
PID 2528 wrote to memory of 624	2528	2025-03-11_24250744c142cfd910615124bd110528_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe	32
PID 2528 wrote to memory of 624	2528	2025-03-11_24250744c142cfd910615124bd110528_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe	32
PID 540 wrote to memory of 2456	540	cmd.exe	33
PID 540 wrote to memory of 2456	540	cmd.exe	33
PID 540 wrote to memory of 2456	540	cmd.exe	33
PID 540 wrote to memory of 2456	540	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\2025-03-11_24250744c142cfd910615124bd110528_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-11_24250744c142cfd910615124bd110528_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cPandaVPN.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Users\Admin\AppData\Local\Temp\cPandaVPN.exe
    cPandaVPN.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cPandaVPN.exe

Filesize
1.8MB

MD5
1a5bebf9a73647413a0b1551bfc9a98f

SHA1
4ded47793a0e13ae81bad7074fd5e449ab1d8e02

SHA256
12bac1cb4ec2e08b80bb2d1039368f0d6eedcf98a4cbe116c62b62f31d191cad

SHA512
e5943e707003e280ed23fbad2c5e64794218580f0f20febc921340c6533d7b1119f4cd73887678a6bba5f66c015ff9d2f8fd7b25fa0bb046e4a1be5ee63f6586

Download Submit
memory/624-9-0x0000000002D80000-0x0000000002E00000-memory.dmp

Filesize
512KB

Download
memory/624-10-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/624-11-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/624-15-0x0000000002D80000-0x0000000002E00000-memory.dmp

Filesize
512KB

Download
memory/2456-3-0x00000000742BE000-0x00000000742BF000-memory.dmp

Filesize
4KB

Download
memory/2456-8-0x00000000001F0000-0x00000000003B8000-memory.dmp

Filesize
1.8MB

Download
memory/2456-12-0x00000000007F0000-0x00000000007FA000-memory.dmp

Filesize
40KB

Download
memory/2456-13-0x00000000007F0000-0x00000000007FA000-memory.dmp

Filesize
40KB

Download
memory/2456-14-0x00000000742BE000-0x00000000742BF000-memory.dmp

Filesize
4KB

Download
memory/2456-16-0x00000000007F0000-0x00000000007FA000-memory.dmp

Filesize
40KB

Download
memory/2456-17-0x00000000007F0000-0x00000000007FA000-memory.dmp

Filesize
40KB

Download