pandastealer | 2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7

General

Target

2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
Size

1.7MB
MD5

e14581bb18a5781d20545143ecb9ee23
SHA1

1dfaeab9ce8eeecef4aedf43cd1a85fa9e044fd8
SHA256

2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7
SHA512

6bf5bfaea695166e82412120a9771d5b66e518ed9b9495a3f3a54ce268ac7876dc8b67e1592d1813aa5add17cc52015c214dd320483e6a6a5282d1402464bc6a

Score

10^/10

pandastealer stealer

Malware Config

Signatures

Panda Stealer Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1816-138-0x0000000000400000-0x00000000004AD000-memory.dmp	family_pandastealer
behavioral2/memory/1816-139-0x0000000000400000-0x00000000004AD000-memory.dmp	family_pandastealer
behavioral2/memory/1816-140-0x0000000000400000-0x00000000004AD000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

Processes:

2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe

description	pid	process	target process
PID 1244 set thread context of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1020 1816 WerFault.exe 2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe

pid	pid_target	process	target process
1020	1816	WerFault.exe	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe

pid	process
1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe

description pid process

Token: SeDebugPrivilege 1244 2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe

description	pid	process
Token: SeDebugPrivilege	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe

description	pid	process	target process
PID 1244 wrote to memory of 1696	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
PID 1244 wrote to memory of 1696	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
PID 1244 wrote to memory of 1696	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
PID 1244 wrote to memory of 1816	1244	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe	2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe

C:\Users\Admin\AppData\Local\Temp\2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
"C:\Users\Admin\AppData\Local\Temp\2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244

C:\Users\Admin\AppData\Local\Temp\2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
"{path}"
2⤵
PID:1696

C:\Users\Admin\AppData\Local\Temp\2b243f747a3ef736ee2b397160a8e68ef9c506281ad22a0d4e73f79d8951c8c7.exe
"{path}"
2⤵
PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 372
3⤵
- Program crash
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 1816 -ip 1816
1⤵
PID:4432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-130-0x00000000006B0000-0x0000000000868000-memory.dmp

Filesize
1.7MB

Download
memory/1244-131-0x0000000005750000-0x0000000005CF4000-memory.dmp

Filesize
5.6MB

Download
memory/1244-132-0x0000000005240000-0x00000000052D2000-memory.dmp

Filesize
584KB

Download
memory/1244-133-0x00000000743E0000-0x0000000074B90000-memory.dmp

Filesize
7.7MB

Download
memory/1244-134-0x0000000005230000-0x000000000523A000-memory.dmp

Filesize
40KB

Download
memory/1244-135-0x00000000051A0000-0x0000000005744000-memory.dmp

Filesize
5.6MB

Download
memory/1244-136-0x0000000009000000-0x000000000952C000-memory.dmp

Filesize
5.2MB

Download
memory/1244-137-0x0000000008B70000-0x0000000008C0C000-memory.dmp

Filesize
624KB

Download
memory/1816-138-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1816-139-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1816-140-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads