pandastealer | fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b

General

Target

fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
Size

7.5MB
MD5

526da47ac5b7fa7337de97616ae4b753
SHA1

6f367937fc01d13a05c5c93abab6560bbd9dbcc5
SHA256

fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b
SHA512

a51e1c9f4c3097bb1de38f047e1b28084784e73f453f1873010371175bac0d59b24ebd1da8f5d058f9fe0b463501a19d216ef10b3ce3fc6cf82be5969ab54bb9

Score

10^/10

Panda Stealer Payload 3 IoCs

resource	yara_rule
behavioral2/memory/4044-135-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer
behavioral2/memory/4044-136-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer
behavioral2/memory/4044-137-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4284	4044	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4240	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	82
PID 5088 wrote to memory of 4240	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	82
PID 5088 wrote to memory of 4240	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	82
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	83
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	83
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	83
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	83
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	83
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	83
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	83
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	83
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	83
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	83

C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
"C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
  "C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe"
  2⤵
  PID:4240
- C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
  "C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe"
  2⤵
  PID:4044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 384
    3⤵
    - Program crash
    PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4044 -ip 4044
1⤵
PID:2872

memory/4044-135-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4044-136-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4044-137-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/5088-130-0x0000000000B80000-0x00000000012FC000-memory.dmp

Filesize
7.5MB

Download
memory/5088-131-0x0000000005CA0000-0x0000000005D3C000-memory.dmp

Filesize
624KB

Download
memory/5088-132-0x00000000063B0000-0x0000000006954000-memory.dmp

Filesize
5.6MB

Download