pandastealer | 34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789

General

Target

34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
Size

5.0MB
MD5

69ef826f3d9a3aca327e938327d91644
SHA1

43e9c02b386564fb46425feaf5e7a29096c01f0d
SHA256

34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789
SHA512

93457365d0ab55d3de9828d98f411dbe1c3435c25ecf16f92d0a6b9e9028ee4a1b896101d042eef486759b935abb99ea1f93607764e184adc84d0825e675013d

Score

10^/10

pandastealer spyware stealer

Malware Config

Signatures

Panda Stealer Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2624-136-0x0000000000400000-0x00000000004AF000-memory.dmp	family_pandastealer
behavioral2/memory/2624-137-0x0000000000400000-0x00000000004AF000-memory.dmp	family_pandastealer
behavioral2/memory/2624-138-0x0000000000400000-0x00000000004AF000-memory.dmp	family_pandastealer
behavioral2/memory/2624-139-0x0000000000400000-0x00000000004AF000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe

description	pid	process	target process
PID 3136 set thread context of 2624	3136	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe

pid	process
2624	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
2624	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe

description	pid	process	target process
PID 3136 wrote to memory of 2624	3136	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
PID 3136 wrote to memory of 2624	3136	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
PID 3136 wrote to memory of 2624	3136	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
PID 3136 wrote to memory of 2624	3136	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
PID 3136 wrote to memory of 2624	3136	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
PID 3136 wrote to memory of 2624	3136	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
PID 3136 wrote to memory of 2624	3136	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
PID 3136 wrote to memory of 2624	3136	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
PID 3136 wrote to memory of 2624	3136	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
PID 3136 wrote to memory of 2624	3136	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe	34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe

C:\Users\Admin\AppData\Local\Temp\34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
"C:\Users\Admin\AppData\Local\Temp\34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Users\Admin\AppData\Local\Temp\34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe
  "C:\Users\Admin\AppData\Local\Temp\34aa8ab1fdfbb0507d22838b8f618704efef899694d494b00dcc1a315fa86789.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2624-135-0x0000000000000000-mapping.dmp

Download
memory/2624-136-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2624-137-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2624-138-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2624-139-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3136-130-0x0000000000910000-0x0000000000E06000-memory.dmp

Filesize
5.0MB

Download
memory/3136-131-0x0000000005810000-0x00000000058AC000-memory.dmp

Filesize
624KB

Download
memory/3136-132-0x00000000092E0000-0x0000000009884000-memory.dmp

Filesize
5.6MB

Download
memory/3136-133-0x00000000069B0000-0x0000000006A42000-memory.dmp

Filesize
584KB

Download
memory/3136-134-0x0000000003400000-0x000000000340A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads