Analysis
-
max time kernel
110s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
10-01-2022 00:01
Static task
static1
Behavioral task
behavioral1
Sample
f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe
-
Size
1.2MB
-
MD5
7253e37821a58f94999228a8d8655e9c
-
SHA1
3a5d828823e6c05e996e0227a97d85a63edc4ad1
-
SHA256
f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a
-
SHA512
f0053ea7526d37e5d6c0bdb8d945e984278a4ca67ab19f50efb90203c86337f18188786ada105cb214346d6fd7cc99c0d0ac3776e2e18acd105591d50f99a217
Score
10/10
Malware Config
Signatures
-
Panda Stealer Payload 3 IoCs
resource yara_rule behavioral1/memory/2776-117-0x0000000000180000-0x000000000028F000-memory.dmp family_pandastealer behavioral1/memory/2776-119-0x0000000000180000-0x000000000028F000-memory.dmp family_pandastealer behavioral1/memory/2776-120-0x0000000000180000-0x000000000028F000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2776 f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2776 f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe 2776 f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe 2776 f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe 2776 f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe"C:\Users\Admin\AppData\Local\Temp\f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2776