Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
13-02-2022 10:08
Static task
static1
Behavioral task
behavioral1
Sample
12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe
Resource
win10v2004-en-20220112
General
-
Target
12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe
-
Size
1.1MB
-
MD5
51742a4508425c35b73662e12f6c1cb5
-
SHA1
d65b66a7c59f070dc1a35b563b753f4eddfdd431
-
SHA256
12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af
-
SHA512
1330f7e246eeb600bf60d972cd05c9a3f0a0558955d75958cff6f62b86c43c8a9386eed1fc5433c290f0c1db4b853d0403bd56f2451444f0a8e6311f6b6ba052
Malware Config
Signatures
-
Panda Stealer Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/472-62-0x0000000000400000-0x0000000000497000-memory.dmp family_pandastealer behavioral1/memory/472-63-0x0000000000400000-0x0000000000497000-memory.dmp family_pandastealer behavioral1/memory/472-64-0x0000000000400000-0x0000000000497000-memory.dmp family_pandastealer behavioral1/memory/472-65-0x0000000000400000-0x0000000000497000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exedescription pid process target process PID 1680 set thread context of 472 1680 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exedescription pid process target process PID 1680 wrote to memory of 472 1680 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe PID 1680 wrote to memory of 472 1680 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe PID 1680 wrote to memory of 472 1680 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe PID 1680 wrote to memory of 472 1680 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe PID 1680 wrote to memory of 472 1680 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe PID 1680 wrote to memory of 472 1680 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe PID 1680 wrote to memory of 472 1680 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe PID 1680 wrote to memory of 472 1680 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe PID 1680 wrote to memory of 472 1680 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe PID 1680 wrote to memory of 472 1680 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe PID 1680 wrote to memory of 472 1680 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe 12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe"C:\Users\Admin\AppData\Local\Temp\12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe"C:\Users\Admin\AppData\Local\Temp\12fdab70f2ce661a0cd09c7862edb45aa9c974a564d1236dacf7ae81decd95af.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/472-59-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/472-60-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/472-61-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/472-62-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/472-63-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/472-64-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/472-65-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/1680-54-0x0000000000B10000-0x0000000000C22000-memory.dmpFilesize
1.1MB
-
memory/1680-55-0x00000000744FE000-0x00000000744FF000-memory.dmpFilesize
4KB
-
memory/1680-56-0x0000000004C00000-0x0000000004CEE000-memory.dmpFilesize
952KB
-
memory/1680-57-0x0000000000A60000-0x0000000000A61000-memory.dmpFilesize
4KB
-
memory/1680-58-0x0000000000A40000-0x0000000000A5C000-memory.dmpFilesize
112KB