Analysis

  • max time kernel
    63s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    24-05-2022 22:02

General

  • Target

    27c4e6145a383919af1c54a10a279e07002a4e774006ccc0a7f8dd609c81d4b9.exe

  • Size

    1.3MB

  • MD5

    518e2ebf1c5ac4f2cdfd5dd81fa60ec7

  • SHA1

    cfc5904e2457fdf92230391b025acd9b607f0232

  • SHA256

    27c4e6145a383919af1c54a10a279e07002a4e774006ccc0a7f8dd609c81d4b9

  • SHA512

    c147c0145231b255a4336354ecd1797f1b44c6b2a6b0766aed769fb550eac1a5af5c06f1ec364c7c1b71cc986ac52222695a810726bc293ac7830e3172c10cdc

Malware Config

Extracted

Family

pandastealer

Version

1.10

C2

http://u808504gws.ha004.t.justns.ru

Signatures

  • Panda Stealer Payload 4 IoCs
  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27c4e6145a383919af1c54a10a279e07002a4e774006ccc0a7f8dd609c81d4b9.exe
    "C:\Users\Admin\AppData\Local\Temp\27c4e6145a383919af1c54a10a279e07002a4e774006ccc0a7f8dd609c81d4b9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Users\Admin\AppData\Local\Temp\27c4e6145a383919af1c54a10a279e07002a4e774006ccc0a7f8dd609c81d4b9.exe
      "{path}"
      2⤵
        PID:4972

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2884-130-0x0000000000FF0000-0x000000000113A000-memory.dmp

      Filesize

      1.3MB

    • memory/2884-131-0x00000000061D0000-0x0000000006774000-memory.dmp

      Filesize

      5.6MB

    • memory/2884-132-0x0000000005C20000-0x0000000005CB2000-memory.dmp

      Filesize

      584KB

    • memory/2884-133-0x0000000005DA0000-0x0000000005E3C000-memory.dmp

      Filesize

      624KB

    • memory/4972-135-0x0000000000400000-0x000000000045A000-memory.dmp

      Filesize

      360KB

    • memory/4972-136-0x0000000000400000-0x000000000045A000-memory.dmp

      Filesize

      360KB

    • memory/4972-134-0x0000000000000000-mapping.dmp

    • memory/4972-137-0x0000000000400000-0x000000000045A000-memory.dmp

      Filesize

      360KB

    • memory/4972-138-0x0000000000400000-0x000000000045A000-memory.dmp

      Filesize

      360KB