Analysis
-
max time kernel
110s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
10-01-2022 00:01
Static task
static1
Behavioral task
behavioral1
Sample
f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe
Resource
win10-en-20211208
General
-
Target
f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe
-
Size
1.2MB
-
MD5
7253e37821a58f94999228a8d8655e9c
-
SHA1
3a5d828823e6c05e996e0227a97d85a63edc4ad1
-
SHA256
f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a
-
SHA512
f0053ea7526d37e5d6c0bdb8d945e984278a4ca67ab19f50efb90203c86337f18188786ada105cb214346d6fd7cc99c0d0ac3776e2e18acd105591d50f99a217
Malware Config
Signatures
-
Panda Stealer Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2776-117-0x0000000000180000-0x000000000028F000-memory.dmp family_pandastealer behavioral1/memory/2776-119-0x0000000000180000-0x000000000028F000-memory.dmp family_pandastealer behavioral1/memory/2776-120-0x0000000000180000-0x000000000028F000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exepid process 2776 f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exepid process 2776 f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe 2776 f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe 2776 f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe 2776 f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe"C:\Users\Admin\AppData\Local\Temp\f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2776-115-0x0000000002340000-0x000000000238C000-memory.dmpFilesize
304KB
-
memory/2776-116-0x0000000000180000-0x000000000028F000-memory.dmpFilesize
1.1MB
-
memory/2776-117-0x0000000000180000-0x000000000028F000-memory.dmpFilesize
1.1MB
-
memory/2776-118-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/2776-119-0x0000000000180000-0x000000000028F000-memory.dmpFilesize
1.1MB
-
memory/2776-120-0x0000000000180000-0x000000000028F000-memory.dmpFilesize
1.1MB
-
memory/2776-121-0x00000000757B0000-0x0000000075972000-memory.dmpFilesize
1.8MB
-
memory/2776-122-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-123-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-125-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-124-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-126-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-127-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-129-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-128-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-130-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-131-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-132-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-133-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-134-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-135-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-136-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-137-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-138-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-139-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-140-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-141-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-142-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-143-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-144-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-145-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-146-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-148-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-149-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-147-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-150-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-151-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-153-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-152-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-154-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-155-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-156-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-158-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-157-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-159-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-160-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-161-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-162-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-163-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-164-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-165-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-166-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-167-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-168-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-169-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-170-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-171-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-172-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-173-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-174-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-176-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-175-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-177-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-178-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB
-
memory/2776-179-0x0000000000181000-0x0000000000207000-memory.dmpFilesize
536KB