Analysis
- user interaction
yes - max time kernel
26s - max time network
8s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
18/04/2026, 01:24
General
- Target ExoPanda_Setup.exe
- Size 2.8MB
- Sample260418-bspncsev6x
- SHA256 3c74eb8d130e49bd19309892e175fb97ebeedad534f587925bfabfad07416da5
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Kills process with taskkill 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExoPanda_Setup.exe"C:\Users\Admin\AppData\Local\Temp\ExoPanda_Setup.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ExoPanda.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
NScurl.dll
System.dll
cookies.txt
modern-wizard.bmp
nsDialogs.dll
nsExec.dll
nsJSON.dll
memory/3168-35-0x0000000000A00000-0x0000000000A82000-memory.dmp
memory/3168-36-0x00000000736F0000-0x0000000073E58000-memory.dmp
memory/3168-46-0x0000000000A00000-0x0000000000A82000-memory.dmp
memory/4352-16-0x00000000015D0000-0x0000000001652000-memory.dmp