pandastealer | 34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789

General

Target

34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
Size

5.0MB
MD5

69ef826f3d9a3aca327e938327d91644
SHA1

43e9c02b386564fb46425feaf5e7a29096c01f0d
SHA256

34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789
SHA512

93457365d0ab55d3de9828d98f411dbe1c3435c25ecf16f92d0a6b9e9028ee4a1b896101d042eef486759b935abb99ea1f93607764e184adc84d0825e675013d

Score

10^/10

Malware Config

Signatures

Panda Stealer Payload 7 IoCs

resource	yara_rule
behavioral1/memory/1524-62-0x0000000000400000-0x00000000004AF000-memory.dmp	family_pandastealer
behavioral1/memory/1524-64-0x0000000000400000-0x00000000004AF000-memory.dmp	family_pandastealer
behavioral1/memory/1524-65-0x0000000000400000-0x00000000004AF000-memory.dmp	family_pandastealer
behavioral1/memory/1524-67-0x0000000000400000-0x00000000004AF000-memory.dmp	family_pandastealer
behavioral1/memory/1524-68-0x000000000045E27E-mapping.dmp	family_pandastealer
behavioral1/memory/1524-70-0x0000000000400000-0x00000000004AF000-memory.dmp	family_pandastealer
behavioral1/memory/1524-71-0x0000000000400000-0x00000000004AF000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 1524	1972	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1524	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1524	1972	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	27
PID 1972 wrote to memory of 1524	1972	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	27
PID 1972 wrote to memory of 1524	1972	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	27
PID 1972 wrote to memory of 1524	1972	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	27
PID 1972 wrote to memory of 1524	1972	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	27
PID 1972 wrote to memory of 1524	1972	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	27
PID 1972 wrote to memory of 1524	1972	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	27
PID 1972 wrote to memory of 1524	1972	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	27
PID 1972 wrote to memory of 1524	1972	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	27
PID 1972 wrote to memory of 1524	1972	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	27
PID 1972 wrote to memory of 1524	1972	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	27

C:\Users\Admin\AppData\Local\Temp\34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
"C:\Users\Admin\AppData\Local\Temp\34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
  "C:\Users\Admin\AppData\Local\Temp\34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-62-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1524-57-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1524-58-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1524-60-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1524-64-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1524-65-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1524-67-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1524-70-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1524-71-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1972-55-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x00000000082E0000-0x0000000008396000-memory.dmp

Filesize
728KB

Download
memory/1972-54-0x0000000000E80000-0x0000000001376000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing