pandastealer | 914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6

General

Target

914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe
Size

1.1MB
MD5

f8e432d36ebd685d203d761081c8287f
SHA1

d3c76ce501250cfbfd9c15bcf8d9d92645f6103f
SHA256

914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6
SHA512

2350b8f7350c416b97cf13e8fcb99a83609dfaf02143e74ff3b9e851edb1d6ce55a6dc0f6b8ae43ee582fd6acc2d50641e79da7059c81b5953625dcf651c0220

Score

10^/10

pandastealer spyware stealer

Malware Config

Extracted

Family

pandastealer

Version

1.11

C2

http://u843854nsj.ha004.t.justns.ru

Signatures

Panda Stealer Payload 4 IoCs

resource	yara_rule
behavioral2/memory/840-137-0x0000000000400000-0x00000000004A8000-memory.dmp	family_pandastealer
behavioral2/memory/840-138-0x0000000000400000-0x00000000004A8000-memory.dmp	family_pandastealer
behavioral2/memory/840-139-0x0000000000400000-0x00000000004A8000-memory.dmp	family_pandastealer
behavioral2/memory/840-140-0x0000000000400000-0x00000000004A8000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 840	1620	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
840	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe
840	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 840	1620	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	88
PID 1620 wrote to memory of 840	1620	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	88
PID 1620 wrote to memory of 840	1620	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	88
PID 1620 wrote to memory of 840	1620	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	88
PID 1620 wrote to memory of 840	1620	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	88
PID 1620 wrote to memory of 840	1620	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	88
PID 1620 wrote to memory of 840	1620	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	88
PID 1620 wrote to memory of 840	1620	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	88
PID 1620 wrote to memory of 840	1620	914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe	88

C:\Users\Admin\AppData\Local\Temp\914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe
"C:\Users\Admin\AppData\Local\Temp\914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe
  "C:\Users\Admin\AppData\Local\Temp\914410cb4eda2096fda7793bb477791d4d9359aa02ece5de7d0a36a4af11ddd6.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-137-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/840-138-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/840-139-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/840-140-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1620-130-0x0000000000460000-0x0000000000588000-memory.dmp

Filesize
1.2MB

Download
memory/1620-131-0x00000000051B0000-0x000000000524C000-memory.dmp

Filesize
624KB

Download
memory/1620-132-0x0000000005800000-0x0000000005DA4000-memory.dmp

Filesize
5.6MB

Download
memory/1620-133-0x00000000052F0000-0x0000000005382000-memory.dmp

Filesize
584KB

Download
memory/1620-134-0x00000000052A0000-0x00000000052AA000-memory.dmp

Filesize
40KB

Download
memory/1620-135-0x00000000053F0000-0x0000000005446000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing