pennywise | 4bb1da6917a1e74dc129027e703c434e76d457e4ed5fdae0df549ac737746c0c

General

Target
pilotredsun - Riverdance.m4a
Size 6.7MB
Sample260807-x5dbrabm3y
SHA256 4bb1da6917a1e74dc129027e703c434e76d457e4ed5fdae0df549ac737746c0c
MD5 6c3c84ee46cbacec30735c3fcdd66502
SHA1 514e51d8594c10c0c8e8d36a9dd016369d029668
SHA512 cbff46bd0d725e576dc202defff1a3469e42004426b569ec98850572dab7ef6465815ae2d547a7c9620f41bbf39c57c3d391ccbf3a5a436e45a91f4556e2d0bc
SSDEEP 196608:qrFH76AeYSV26lUcBALK0EmmpZEgPP/Xl0:qpQ26i5LK0EmsEgn/O
TLSH
T1F46633597D81EF01776AD96C10E4C82EF3FED5C3D862E40F96625A599138E8E02BF4B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  pilotredsun - Riverdance.m4a
- Size 6.7MB
- SHA256 4bb1da6917a1e74dc129027e703c434e76d457e4ed5fdae0df549ac737746c0c
- MD5 6c3c84ee46cbacec30735c3fcdd66502
- SHA1 514e51d8594c10c0c8e8d36a9dd016369d029668
- SHA512 cbff46bd0d725e576dc202defff1a3469e42004426b569ec98850572dab7ef6465815ae2d547a7c9620f41bbf39c57c3d391ccbf3a5a436e45a91f4556e2d0bc
- SSDEEP 196608:qrFH76AeYSV26lUcBALK0EmmpZEgPP/Xl0:qpQ26i5LK0EmsEgn/O
- TLSH
  T1F46633597D81EF01776AD96C10E4C82EF3FED5C3D862E40F96625A599138E8E02BF4B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution pennywise salatstealer umbral persistence privilege_escalation ransomware spyware stealer upx adware trojan
- Detect SalatStealer payload
- Detects PennyWise
  stealer
- Detects Umbral payload
- Family: PennyWise
  PennyWise is a stealer written in C#.
  stealer pennywise
- Family: Umbral
  Umbral stealer is an open-source modular stealer written in C#.
  stealer umbral
- Family: salatstealer
  SalatStealer is a stealer that takes sceenshot written in Golang.
  stealer salatstealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies RDP port number used by Windows
- Patched UPX-packed file
  Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2