pandastealer | fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b

General

Target

fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
Size

7.5MB
MD5

526da47ac5b7fa7337de97616ae4b753
SHA1

6f367937fc01d13a05c5c93abab6560bbd9dbcc5
SHA256

fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b
SHA512

a51e1c9f4c3097bb1de38f047e1b28084784e73f453f1873010371175bac0d59b24ebd1da8f5d058f9fe0b463501a19d216ef10b3ce3fc6cf82be5969ab54bb9

Score

10^/10

Malware Config

Signatures

Panda Stealer Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1016-61-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer
behavioral1/memory/1016-63-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer
behavioral1/memory/1016-64-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer
behavioral1/memory/1016-66-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer
behavioral1/memory/1016-67-0x000000000045DDB5-mapping.dmp	family_pandastealer
behavioral1/memory/1016-69-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 1016	1808	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1904	1016	WerFault.exe	29

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1016	1808	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	29
PID 1808 wrote to memory of 1016	1808	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	29
PID 1808 wrote to memory of 1016	1808	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	29
PID 1808 wrote to memory of 1016	1808	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	29
PID 1808 wrote to memory of 1016	1808	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	29
PID 1808 wrote to memory of 1016	1808	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	29
PID 1808 wrote to memory of 1016	1808	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	29
PID 1808 wrote to memory of 1016	1808	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	29
PID 1808 wrote to memory of 1016	1808	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	29
PID 1808 wrote to memory of 1016	1808	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	29
PID 1808 wrote to memory of 1016	1808	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	29
PID 1016 wrote to memory of 1904	1016	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	30
PID 1016 wrote to memory of 1904	1016	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	30
PID 1016 wrote to memory of 1904	1016	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	30
PID 1016 wrote to memory of 1904	1016	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	30

C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
"C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
  "C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 140
    3⤵
    - Program crash
    PID:1904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-56-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1016-57-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1016-59-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1016-61-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1016-63-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1016-64-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1016-66-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1016-69-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1808-54-0x0000000000AB0000-0x000000000122C000-memory.dmp

Filesize
7.5MB

Download
memory/1808-55-0x0000000000940000-0x0000000000A00000-memory.dmp

Filesize
768KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads