Overview

overview

10

Static

static

10

b59f27deda...5b.exe

windows7_x64

10

b59f27deda...5b.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    4294179s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    19-03-2022 12:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b59f27dedadd616a884740a63e360bd8484f75db0e6c90b199b5c15c5a10d85b.exe

  • Size

    1.9MB

  • MD5

    d75d016964ffb38a1786645747f81a12

  • SHA1

    8b792fcb8d1c2960180b427c4fc7c2d2e2e2f000

  • SHA256

    b59f27dedadd616a884740a63e360bd8484f75db0e6c90b199b5c15c5a10d85b

  • SHA512

    ad755146867b79d1e75ea09a2ccb990b5f8f3b80303a4811b53632a7fbd0e55826c863406d1c49f324ec7ce58e0e855f24f7b202cb3e515077482ee526745653

Score
10/10
pandastealerspywarestealervmprotect

Malware Config

Signatures

  • Panda Stealer Payload 1 IoCs
  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b59f27dedadd616a884740a63e360bd8484f75db0e6c90b199b5c15c5a10d85b.exe
    "C:\Users\Admin\AppData\Local\Temp\b59f27dedadd616a884740a63e360bd8484f75db0e6c90b199b5c15c5a10d85b.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/852-55-0x0000000000140000-0x0000000000491000-memory.dmp
    Filesize

    3.3MB

    Download
  • memory/852-57-0x00000000760A1000-0x00000000760A3000-memory.dmp
    Filesize

    8KB

    Download