pandastealer | 914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6

General

Target

914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe
Size

1.1MB
MD5

f8e432d36ebd685d203d761081c8287f
SHA1

d3c76ce501250cfbfd9c15bcf8d9d92645f6103f
SHA256

914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6
SHA512

2350b8f7350c416b97cf13e8fcb99a83609dfaf02143e74ff3b9e851edb1d6ce55a6dc0f6b8ae43ee582fd6acc2d50641e79da7059c81b5953625dcf651c0220

Score

10^/10

pandastealer spyware stealer

Malware Config

Extracted

Family

pandastealer

Version

1.11

C2

http://u843854nsj.ha004.t.justns.ru

Signatures

Panda Stealer Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1376-69-0x0000000000400000-0x00000000004A8000-memory.dmp	family_pandastealer
behavioral1/memory/1376-70-0x000000000045B3A7-mapping.dmp	family_pandastealer
behavioral1/memory/1376-72-0x0000000000400000-0x00000000004A8000-memory.dmp	family_pandastealer
behavioral1/memory/1376-67-0x0000000000400000-0x00000000004A8000-memory.dmp	family_pandastealer
behavioral1/memory/1376-65-0x0000000000400000-0x00000000004A8000-memory.dmp	family_pandastealer
behavioral1/memory/1376-73-0x0000000000400000-0x00000000004A8000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 776 set thread context of 1376	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe
1376	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 1456	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	28
PID 776 wrote to memory of 1456	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	28
PID 776 wrote to memory of 1456	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	28
PID 776 wrote to memory of 1456	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	28
PID 776 wrote to memory of 1376	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	29
PID 776 wrote to memory of 1376	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	29
PID 776 wrote to memory of 1376	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	29
PID 776 wrote to memory of 1376	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	29
PID 776 wrote to memory of 1376	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	29
PID 776 wrote to memory of 1376	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	29
PID 776 wrote to memory of 1376	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	29
PID 776 wrote to memory of 1376	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	29
PID 776 wrote to memory of 1376	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	29
PID 776 wrote to memory of 1376	776	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	29

C:\Users\Admin\AppData\Local\Temp\914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe
"C:\Users\Admin\AppData\Local\Temp\914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776
- C:\Users\Admin\AppData\Local\Temp\914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe
  "C:\Users\Admin\AppData\Local\Temp\914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe"
  2⤵
  PID:1456
- C:\Users\Admin\AppData\Local\Temp\914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe
  "C:\Users\Admin\AppData\Local\Temp\914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-54-0x0000000000110000-0x0000000000238000-memory.dmp

Filesize
1.2MB

Download
memory/776-55-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/776-56-0x0000000004D50000-0x0000000004E20000-memory.dmp

Filesize
832KB

Download
memory/776-57-0x00000000007A0000-0x00000000007A8000-memory.dmp

Filesize
32KB

Download
memory/776-58-0x00000000059A0000-0x0000000005A6C000-memory.dmp

Filesize
816KB

Download
memory/776-59-0x0000000005A70000-0x0000000005B1C000-memory.dmp

Filesize
688KB

Download
memory/1376-61-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1376-69-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1376-72-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1376-67-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1376-65-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1376-63-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1376-60-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1376-73-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download

Analysis

Sharing