pandastealer | 2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7

General

Target

2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
Size

1.7MB
MD5

e14581bb18a5781d20545143ecb9ee23
SHA1

1dfaeab9ce8eeecef4aedf43cd1a85fa9e044fd8
SHA256

2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7
SHA512

6bf5bfaea695166e82412120a9771d5b66e518ed9b9495a3f3a54ce268ac7876dc8b67e1592d1813aa5add17cc52015c214dd320483e6a6a5282d1402464bc6a

Score

10^/10

Panda Stealer Payload 3 IoCs

resource	yara_rule
behavioral2/memory/1816-138-0x0000000000400000-0x00000000004AD000-memory.dmp	family_pandastealer
behavioral2/memory/1816-139-0x0000000000400000-0x00000000004AD000-memory.dmp	family_pandastealer
behavioral2/memory/1816-140-0x0000000000400000-0x00000000004AD000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1244 set thread context of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	91

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1020	1816	WerFault.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1696	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	90
PID 1244 wrote to memory of 1696	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	90
PID 1244 wrote to memory of 1696	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	90
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	91
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	91
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	91
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	91
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	91
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	91
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	91
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	91
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	91

C:\Users\Admin\AppData\Local\Temp\2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
"C:\Users\Admin\AppData\Local\Temp\2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
  "{path}"
  2⤵
  PID:1696
- C:\Users\Admin\AppData\Local\Temp\2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
  "{path}"
  2⤵
  PID:1816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 372
    3⤵
    - Program crash
    PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 1816 -ip 1816
1⤵
PID:4432

memory/1244-130-0x00000000006B0000-0x0000000000868000-memory.dmp

Filesize
1.7MB

Download
memory/1244-131-0x0000000005750000-0x0000000005CF4000-memory.dmp

Filesize
5.6MB

Download
memory/1244-132-0x0000000005240000-0x00000000052D2000-memory.dmp

Filesize
584KB

Download
memory/1244-133-0x00000000743E0000-0x0000000074B90000-memory.dmp

Filesize
7.7MB

Download
memory/1244-134-0x0000000005230000-0x000000000523A000-memory.dmp

Filesize
40KB

Download
memory/1244-135-0x00000000051A0000-0x0000000005744000-memory.dmp

Filesize
5.6MB

Download
memory/1244-136-0x0000000009000000-0x000000000952C000-memory.dmp

Filesize
5.2MB

Download
memory/1244-137-0x0000000008B70000-0x0000000008C0C000-memory.dmp

Filesize
624KB

Download
memory/1816-138-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1816-139-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1816-140-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download