pandastealer | 61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5

Analysis

max time kernel
4294218s
max time network
124s
platform
windows7_x64
resource
win7-20220311-en
submitted
19-03-2022 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe
Size

2.5MB
MD5

ed08f49312feadd6690473e54ea2ebea
SHA1

3aac4c372c6fbef8370434ac97172ebd9f39e105
SHA256

61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5
SHA512

9817fdf570e9334f649ec908f2d223803d449e62ba9793d35af8ce658551c7136e4d76f55daa01d540bbb1c0a3d021cd2af339c0d8c31b810acad9f1daac218e

Score

10^/10

pandastealer spyware stealer vmprotect

Malware Config

Signatures

Panda Stealer Payload 5 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe	family_pandastealer
\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe	family_pandastealer
\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe	family_pandastealer
\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe	family_pandastealer
C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Executes dropped EXE 2 IoCs

Processes:

1511528223_MT.exeCheat_SanyaTop.exe

pid process

760 1511528223_MT.exe
1740 Cheat_SanyaTop.exe

pid	process
760	1511528223_MT.exe
1740	Cheat_SanyaTop.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1328-63-0x00000000012F0000-0x0000000001813000-memory.dmp	vmprotect
behavioral1/memory/1328-70-0x00000000012F0000-0x0000000001813000-memory.dmp	vmprotect

Loads dropped DLL 8 IoCs

Processes:

61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe

pid	process
1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe
1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe
1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe
1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe
1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe
1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe
1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe
1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1328-63-0x00000000012F0000-0x0000000001813000-memory.dmp	autoit_exe
behavioral1/memory/1328-70-0x00000000012F0000-0x0000000001813000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe

pid process

1328 61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe1511528223_MT.exeCheat_SanyaTop.exe

pid	process
1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe
760	1511528223_MT.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe
1740	Cheat_SanyaTop.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Cheat_SanyaTop.exe

description pid process

Token: SeDebugPrivilege 1740 Cheat_SanyaTop.exe

description	pid	process
Token: SeDebugPrivilege	1740	Cheat_SanyaTop.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe

description	pid	process	target process
PID 1328 wrote to memory of 760	1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe	1511528223_MT.exe
PID 1328 wrote to memory of 760	1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe	1511528223_MT.exe
PID 1328 wrote to memory of 760	1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe	1511528223_MT.exe
PID 1328 wrote to memory of 760	1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe	1511528223_MT.exe
PID 1328 wrote to memory of 1740	1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe	Cheat_SanyaTop.exe
PID 1328 wrote to memory of 1740	1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe	Cheat_SanyaTop.exe
PID 1328 wrote to memory of 1740	1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe	Cheat_SanyaTop.exe
PID 1328 wrote to memory of 1740	1328	61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe	Cheat_SanyaTop.exe

C:\Users\Admin\AppData\Local\Temp\61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe
"C:\Users\Admin\AppData\Local\Temp\61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1328

C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe
"C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:760

C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\Cheat_SanyaTop.exe
"C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\Cheat_SanyaTop.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe
MD5
2044768a6469f7a339276fb6a00dbf1a

SHA1
6aab5685f6e9d45fafd703f8a51d7606840387fc

SHA256
9879bb4f831233d2a36ace56535ed479f853c7a878d60f46a93fe07d1d371e67

SHA512
d616e0f12b0325cf864a9cb6298f4ded87548b2307572ba8447b6594b8ce14a8fb181a56d95b454b9ae63d9261ade15d25b3d6bceb1e794bdb8d913622761d9f

Download Submit
C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\Cheat_SanyaTop.exe
MD5
c98771c7a517e4a9cb1e603a115e6c80

SHA1
0154f03560051015cdf49c075961c8144bd65359

SHA256
56924494751713a5c22ada3f11c812a2ecf4957e442fc0bf52194aae4f24c09e

SHA512
c48747fe27708a0b14da7c7007910b5464682947367477378e94d2edcd105eae510bc27eb9ddf9c0820e164b71da297e230d680d9ec6b94948f97d9869a94095

Download Submit
C:\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\Cheat_SanyaTop.exe
MD5
c98771c7a517e4a9cb1e603a115e6c80

SHA1
0154f03560051015cdf49c075961c8144bd65359

SHA256
56924494751713a5c22ada3f11c812a2ecf4957e442fc0bf52194aae4f24c09e

SHA512
c48747fe27708a0b14da7c7007910b5464682947367477378e94d2edcd105eae510bc27eb9ddf9c0820e164b71da297e230d680d9ec6b94948f97d9869a94095

Download Submit
\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe
MD5
2044768a6469f7a339276fb6a00dbf1a

SHA1
6aab5685f6e9d45fafd703f8a51d7606840387fc

SHA256
9879bb4f831233d2a36ace56535ed479f853c7a878d60f46a93fe07d1d371e67

SHA512
d616e0f12b0325cf864a9cb6298f4ded87548b2307572ba8447b6594b8ce14a8fb181a56d95b454b9ae63d9261ade15d25b3d6bceb1e794bdb8d913622761d9f

Download Submit
\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe
MD5
2044768a6469f7a339276fb6a00dbf1a

SHA1
6aab5685f6e9d45fafd703f8a51d7606840387fc

SHA256
9879bb4f831233d2a36ace56535ed479f853c7a878d60f46a93fe07d1d371e67

SHA512
d616e0f12b0325cf864a9cb6298f4ded87548b2307572ba8447b6594b8ce14a8fb181a56d95b454b9ae63d9261ade15d25b3d6bceb1e794bdb8d913622761d9f

Download Submit
\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe
MD5
2044768a6469f7a339276fb6a00dbf1a

SHA1
6aab5685f6e9d45fafd703f8a51d7606840387fc

SHA256
9879bb4f831233d2a36ace56535ed479f853c7a878d60f46a93fe07d1d371e67

SHA512
d616e0f12b0325cf864a9cb6298f4ded87548b2307572ba8447b6594b8ce14a8fb181a56d95b454b9ae63d9261ade15d25b3d6bceb1e794bdb8d913622761d9f

Download Submit
\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\1511528223_MT.exe
MD5
2044768a6469f7a339276fb6a00dbf1a

SHA1
6aab5685f6e9d45fafd703f8a51d7606840387fc

SHA256
9879bb4f831233d2a36ace56535ed479f853c7a878d60f46a93fe07d1d371e67

SHA512
d616e0f12b0325cf864a9cb6298f4ded87548b2307572ba8447b6594b8ce14a8fb181a56d95b454b9ae63d9261ade15d25b3d6bceb1e794bdb8d913622761d9f

Download Submit
\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\Cheat_SanyaTop.exe
MD5
c98771c7a517e4a9cb1e603a115e6c80

SHA1
0154f03560051015cdf49c075961c8144bd65359

SHA256
56924494751713a5c22ada3f11c812a2ecf4957e442fc0bf52194aae4f24c09e

SHA512
c48747fe27708a0b14da7c7007910b5464682947367477378e94d2edcd105eae510bc27eb9ddf9c0820e164b71da297e230d680d9ec6b94948f97d9869a94095

Download Submit
\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\Cheat_SanyaTop.exe
MD5
c98771c7a517e4a9cb1e603a115e6c80

SHA1
0154f03560051015cdf49c075961c8144bd65359

SHA256
56924494751713a5c22ada3f11c812a2ecf4957e442fc0bf52194aae4f24c09e

SHA512
c48747fe27708a0b14da7c7007910b5464682947367477378e94d2edcd105eae510bc27eb9ddf9c0820e164b71da297e230d680d9ec6b94948f97d9869a94095

Download Submit
\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\Cheat_SanyaTop.exe
MD5
c98771c7a517e4a9cb1e603a115e6c80

SHA1
0154f03560051015cdf49c075961c8144bd65359

SHA256
56924494751713a5c22ada3f11c812a2ecf4957e442fc0bf52194aae4f24c09e

SHA512
c48747fe27708a0b14da7c7007910b5464682947367477378e94d2edcd105eae510bc27eb9ddf9c0820e164b71da297e230d680d9ec6b94948f97d9869a94095

Download Submit
\Users\Admin\AppData\Roaming\EPR6EWG1RB1D\Cheat_SanyaTop.exe
MD5
c98771c7a517e4a9cb1e603a115e6c80

SHA1
0154f03560051015cdf49c075961c8144bd65359

SHA256
56924494751713a5c22ada3f11c812a2ecf4957e442fc0bf52194aae4f24c09e

SHA512
c48747fe27708a0b14da7c7007910b5464682947367477378e94d2edcd105eae510bc27eb9ddf9c0820e164b71da297e230d680d9ec6b94948f97d9869a94095

Download Submit
memory/1328-63-0x00000000012F0000-0x0000000001813000-memory.dmp

Filesize
5.1MB

Download
memory/1328-61-0x0000000075750000-0x0000000075751000-memory.dmp

Filesize
4KB

Download
memory/1328-57-0x0000000077920000-0x0000000077921000-memory.dmp

Filesize
4KB

Download
memory/1328-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1328-70-0x00000000012F0000-0x0000000001813000-memory.dmp

Filesize
5.1MB

Download
memory/1328-55-0x0000000077920000-0x0000000077921000-memory.dmp

Filesize
4KB

Download
memory/1740-81-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1740-78-0x0000000000FE0000-0x00000000010A4000-memory.dmp

Filesize
784KB

Download
memory/1740-79-0x0000000074210000-0x00000000748FE000-memory.dmp

Filesize
6.9MB

Download