Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
06-02-2022 20:38
Static task
static1
Behavioral task
behavioral1
Sample
Order_015_pdf.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Order_015_pdf.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Order_015_pdf.exe
-
Size
1.2MB
-
MD5
b21f6724198f32941b6dec8e63a3acd2
-
SHA1
97decceedc4e24d03c45cadafb88940695ccfcae
-
SHA256
5619c8395d506c05cebd14d6145c87a87e52b265a2442aa6dbea431f94c22eef
-
SHA512
4bed4531a9af42611baa88be4ff3229d4040b678c4b87741d09f737ae6d25960581c0df60e380622a15280fc915e0ce51942cb665894a999603e76b1ad93a5dc
Score
10/10
Malware Config
Signatures
-
Panda Stealer Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1088-63-0x0000000000400000-0x00000000004AE000-memory.dmp family_pandastealer behavioral1/memory/1088-64-0x0000000000400000-0x00000000004AE000-memory.dmp family_pandastealer behavioral1/memory/1088-65-0x0000000000400000-0x00000000004AE000-memory.dmp family_pandastealer behavioral1/memory/1088-66-0x0000000000400000-0x00000000004AE000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order_015_pdf.exedescription pid process target process PID 1440 set thread context of 1088 1440 Order_015_pdf.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegSvcs.exepid process 1088 RegSvcs.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Order_015_pdf.exedescription pid process target process PID 1440 wrote to memory of 1088 1440 Order_015_pdf.exe RegSvcs.exe PID 1440 wrote to memory of 1088 1440 Order_015_pdf.exe RegSvcs.exe PID 1440 wrote to memory of 1088 1440 Order_015_pdf.exe RegSvcs.exe PID 1440 wrote to memory of 1088 1440 Order_015_pdf.exe RegSvcs.exe PID 1440 wrote to memory of 1088 1440 Order_015_pdf.exe RegSvcs.exe PID 1440 wrote to memory of 1088 1440 Order_015_pdf.exe RegSvcs.exe PID 1440 wrote to memory of 1088 1440 Order_015_pdf.exe RegSvcs.exe PID 1440 wrote to memory of 1088 1440 Order_015_pdf.exe RegSvcs.exe PID 1440 wrote to memory of 1088 1440 Order_015_pdf.exe RegSvcs.exe PID 1440 wrote to memory of 1088 1440 Order_015_pdf.exe RegSvcs.exe PID 1440 wrote to memory of 1088 1440 Order_015_pdf.exe RegSvcs.exe PID 1440 wrote to memory of 1088 1440 Order_015_pdf.exe RegSvcs.exe PID 1440 wrote to memory of 1088 1440 Order_015_pdf.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order_015_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Order_015_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1088-63-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/1088-60-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/1088-61-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/1088-62-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/1088-64-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/1088-65-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/1088-66-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/1440-55-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/1440-56-0x0000000007220000-0x0000000007221000-memory.dmpFilesize
4KB
-
memory/1440-57-0x00000000004B0000-0x00000000004BA000-memory.dmpFilesize
40KB
-
memory/1440-58-0x000000000A550000-0x000000000A64E000-memory.dmpFilesize
1016KB
-
memory/1440-59-0x000000000BC40000-0x000000000BD22000-memory.dmpFilesize
904KB
-
memory/1440-54-0x0000000000D40000-0x0000000000E80000-memory.dmpFilesize
1.2MB