Overview

overview

10

Static

static

10

ForceNitro.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    67s
  • max time network
    16s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-02-2024 15:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ForceNitro.exe

  • Size

    762KB

  • MD5

    6abff90b8cb80533bca9eb040ed698da

  • SHA1

    ae2e389320bec602965a5f12c13e595df870ac0f

  • SHA256

    70b80a1a24d526e456893f0185550c15c3d914deaf8ebaa02d8817a15aa5bf80

  • SHA512

    086e4c1eb5a32ae116ffeaf28995cf4e660460fec758c1c4708d0df30413b774924e863381b6a46125c09a82570fbde933f24cac8a0691751998eb075fff1813

  • SSDEEP

    12288:RXfl4WqP5C+ZQpvBlUh1ArlVOs/mRtZJhg6VQ/IoDsp+LbMoUA5bQcoln+TMuHat:RXN4WO5upvH4ip/mRtZJVQ/IoDswYg0B

Score
10/10
pandastealerspywarestealer

Malware Config

Signatures

  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ForceNitro.exe
    "C:\Users\Admin\AppData\Local\Temp\ForceNitro.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4800
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C Del /f /q "C:\Users\Admin\AppData\Local\Temp\ForceNitro.exe"
      2⤵
        PID:408
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:5104
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /0
        1⤵
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1476
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          2⤵
            PID:4860

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        2
        T1012

        Peripheral Device Discovery

        1
        T1120

        System Information Discovery

        2
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Exfiltration

        Command and Control

        Impact

        Resource Development

        Reconnaissance

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1476-31-0x00000288381D0000-0x00000288381D1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1476-33-0x00000288381D0000-0x00000288381D1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1476-32-0x00000288381D0000-0x00000288381D1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1476-37-0x00000288381D0000-0x00000288381D1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1476-38-0x00000288381D0000-0x00000288381D1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1476-39-0x00000288381D0000-0x00000288381D1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1476-40-0x00000288381D0000-0x00000288381D1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1476-41-0x00000288381D0000-0x00000288381D1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1476-42-0x00000288381D0000-0x00000288381D1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1476-43-0x00000288381D0000-0x00000288381D1000-memory.dmp
          Filesize

          4KB

          Download