pandastealer | 5b7559ef858b45a1aa79ed59ee28f0a8e4f117c07986f8ca6d5ed5df567a247c

Analysis

max time kernel
10s
max time network
126s
platform
windows10_x64
resource
win10v20210410
submitted
06-07-2021 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ccbb51f967e7942cd25210cf3f210e00.exe
Size

5.0MB
MD5

ccbb51f967e7942cd25210cf3f210e00
SHA1

c6b38fd26b17ebf94d5800b5a6d52cec6d1af329
SHA256

5b7559ef858b45a1aa79ed59ee28f0a8e4f117c07986f8ca6d5ed5df567a247c
SHA512

8fb0f61707569bc690bc9be9c059412fd8febad20d86a1fd11587e365d971fcdd5febb9ba5bc058c75f902ee3504d52641b682817700b2b9cf5a4c26f3bdb4b7

Score

10^/10

pandastealer spyware stealer vmprotect

Malware Config

Signatures

Panda Stealer Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3944-115-0x0000000000400000-0x0000000000C7B000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/3944-115-0x0000000000400000-0x0000000000C7B000-memory.dmp	vmprotect

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ccbb51f967e7942cd25210cf3f210e00.exe

pid	process
3944	ccbb51f967e7942cd25210cf3f210e00.exe
3944	ccbb51f967e7942cd25210cf3f210e00.exe
3944	ccbb51f967e7942cd25210cf3f210e00.exe
3944	ccbb51f967e7942cd25210cf3f210e00.exe

C:\Users\Admin\AppData\Local\Temp\ccbb51f967e7942cd25210cf3f210e00.exe
"C:\Users\Admin\AppData\Local\Temp\ccbb51f967e7942cd25210cf3f210e00.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3944-114-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/3944-115-0x0000000000400000-0x0000000000C7B000-memory.dmp

Filesize
8.5MB

Download