pandastealer | fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b

General

Target

fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
Size

7.5MB
MD5

526da47ac5b7fa7337de97616ae4b753
SHA1

6f367937fc01d13a05c5c93abab6560bbd9dbcc5
SHA256

fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b
SHA512

a51e1c9f4c3097bb1de38f047e1b28084784e73f453f1873010371175bac0d59b24ebd1da8f5d058f9fe0b463501a19d216ef10b3ce3fc6cf82be5969ab54bb9

Score

10^/10

pandastealer stealer

Malware Config

Signatures

Panda Stealer Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4044-135-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer
behavioral2/memory/4044-136-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer
behavioral2/memory/4044-137-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

Processes:

fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe

description	pid	process	target process
PID 5088 set thread context of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4284 4044 WerFault.exe fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe

pid	pid_target	process	target process
4284	4044	WerFault.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe

pid	process
5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe

description pid process

Token: SeDebugPrivilege 5088 fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe

description	pid	process
Token: SeDebugPrivilege	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe

description	pid	process	target process
PID 5088 wrote to memory of 4240	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
PID 5088 wrote to memory of 4240	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
PID 5088 wrote to memory of 4240	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
PID 5088 wrote to memory of 4044	5088	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe	fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe

C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
"C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088

C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
"C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe"
2⤵
PID:4240

C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe
"C:\Users\Admin\AppData\Local\Temp\fa2990657c791b757d6b040bd1f3c32701d07c675e3b273e5b10e4665dc0a37b.exe"
2⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 384
3⤵
- Program crash
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4044 -ip 4044
1⤵
PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4044-134-0x0000000000000000-mapping.dmp

Download
memory/4044-135-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4044-136-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4044-137-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4240-133-0x0000000000000000-mapping.dmp

Download
memory/5088-130-0x0000000000B80000-0x00000000012FC000-memory.dmp

Filesize
7.5MB

Download
memory/5088-131-0x0000000005CA0000-0x0000000005D3C000-memory.dmp

Filesize
624KB

Download
memory/5088-132-0x00000000063B0000-0x0000000006954000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads