Resubmissions
23/09/2026, 17:04
260923-vledlayx6m06/09/2026, 10:43
260906-msd3eashke01/09/2026, 13:41
260901-qzhwqazepg01/09/2026, 12:58
260901-p7y28szbqc1018/08/2026, 20:05
260818-yt533azcke1016/08/2026, 10:12
260816-l8ylbahj9t15/08/2026, 21:01
260815-ztx8wstdla15/08/2026, 20:42
260815-zhhdastyfv14/08/2026, 18:02
260814-wmq98afk9109/08/2026, 10:50
260809-mxkqrazta1Analysis
- max time kernel
600s - max time network
446s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/06/2026, 14:34
General
- Target Supernova/5bf2b0d4b1ac39e443bfedb8785fc5963e85c8f80fce2a91f7d236000a47c98b.exe
- Size 364KB
- Sample260626-rxt2mscs3x
- SHA256 5bf2b0d4b1ac39e443bfedb8785fc5963e85c8f80fce2a91f7d236000a47c98b
Malware Config
Signatures
- Family: PandaZeuS
PandaZeuS is a banking trojan that utilizes the ATS to automate actions within online banking portals.
- Detects PandaZeuS 20 IoCs
- Executes dropped EXE 2 IoCs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 32 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Supernova\5bf2b0d4b1ac39e443bfedb8785fc5963e85c8f80fce2a91f7d236000a47c98b.exe"C:\Users\Admin\AppData\Local\Temp\Supernova\5bf2b0d4b1ac39e443bfedb8785fc5963e85c8f80fce2a91f7d236000a47c98b.exe"1⤵
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\WaitUnlock.exe"C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\WaitUnlock.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\updf62befe3.bat"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\WaitUnlock.exeC:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\WaitUnlock.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
updf62befe3.bat
EnterOpen.kux
EnterOpen.kux
EnterOpen.kux
EnterOpen.kux
EnterOpen.kux
WaitUnlock.exe
memory/628-19-0x0000000002340000-0x0000000002341000-memory.dmp
memory/628-5-0x0000000002340000-0x0000000002341000-memory.dmp
memory/628-0-0x0000000002B50000-0x0000000002C5E000-memory.dmp
memory/628-1-0x0000000002340000-0x0000000002341000-memory.dmp
memory/628-21-0x0000000002340000-0x0000000002360000-memory.dmp
memory/628-2-0x0000000002340000-0x0000000002341000-memory.dmp
memory/628-3-0x0000000002340000-0x0000000002341000-memory.dmp
memory/628-6-0x0000000002340000-0x0000000002341000-memory.dmp
memory/628-35-0x0000000002340000-0x0000000002360000-memory.dmp
memory/628-12-0x0000000002340000-0x0000000002360000-memory.dmp
memory/628-4-0x0000000002B50000-0x0000000002C5E000-memory.dmp
memory/716-45-0x0000000000ED0000-0x0000000000EF0000-memory.dmp
memory/716-46-0x0000000000ED0000-0x0000000000EF0000-memory.dmp
memory/716-37-0x0000000000ED0000-0x0000000000EF0000-memory.dmp
memory/716-40-0x0000000000ED0000-0x0000000000EF0000-memory.dmp
memory/716-41-0x0000000000ED0000-0x0000000000EF0000-memory.dmp
memory/716-42-0x0000000000ED0000-0x0000000000EF0000-memory.dmp
memory/716-43-0x0000000000ED0000-0x0000000000EF0000-memory.dmp
memory/716-44-0x0000000000ED0000-0x0000000000EF0000-memory.dmp
memory/752-167-0x00000000029B0000-0x00000000029D0000-memory.dmp
memory/2072-79-0x00000000005B0000-0x00000000005D0000-memory.dmp
memory/2072-78-0x00000000005B0000-0x00000000005D0000-memory.dmp
memory/2072-77-0x00000000005B0000-0x00000000005D0000-memory.dmp
memory/2072-80-0x00000000005B0000-0x00000000005D0000-memory.dmp
memory/2072-81-0x00000000005B0000-0x00000000005D0000-memory.dmp
memory/2072-82-0x00000000005B0000-0x00000000005D0000-memory.dmp
memory/2072-53-0x00000000005B0000-0x00000000005D0000-memory.dmp
memory/4832-23-0x00000000020B0000-0x00000000020D0000-memory.dmp
memory/4832-36-0x0000000002090000-0x0000000002091000-memory.dmp
memory/4832-22-0x0000000002A80000-0x0000000002B8E000-memory.dmp
memory/4832-20-0x0000000002A80000-0x0000000002B8E000-memory.dmp