pandastealer | e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9

General

Target

e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
Size

1.4MB
MD5

86586f68d3f31daf46c17fb3e7c6d898
SHA1

53e5a38d40031f7b1e98787ac9726b5b09671cad
SHA256

e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9
SHA512

69bf463091c1a55c9ebdbe344104b9114004354b3a83a9eb76f56685dd39bb19e8443f5dc0ee1afb15f4d791d0719f5536f6eec8d24d2cb1e5e9801a32f3dfda
SSDEEP

24576:EFy6K3oR28fpldrwETCB3l/1w/c8t7s+vd2DWF:EFG4R9fpXJeX1VhNw

Score

10^/10

pandastealer spyware stealer

Malware Config

Extracted

Family

pandastealer

Version

1.11

C2

http://en.veres-m.hu

Signatures

Panda Stealer payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3540-139-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer
behavioral2/memory/3540-140-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer
behavioral2/memory/3540-141-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer
behavioral2/memory/3540-142-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer
behavioral2/memory/3540-143-0x0000000000400000-0x00000000004AE000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe

description	pid	process	target process
PID 4824 set thread context of 3540	4824	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe

pid	process
3540	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
3540	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe

description	pid	process	target process
PID 4824 wrote to memory of 3540	4824	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 4824 wrote to memory of 3540	4824	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 4824 wrote to memory of 3540	4824	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 4824 wrote to memory of 3540	4824	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 4824 wrote to memory of 3540	4824	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 4824 wrote to memory of 3540	4824	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 4824 wrote to memory of 3540	4824	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 4824 wrote to memory of 3540	4824	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
PID 4824 wrote to memory of 3540	4824	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe	e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe

C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
"C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4824

C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe
"C:\Users\Admin\AppData\Local\Temp\e9ec3e26c9055bbd0ea512a581c3cfb872819a30f6ed985cfc2841e6f204a1f9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3540

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3540-138-0x0000000000000000-mapping.dmp

Download
memory/3540-139-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/3540-140-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/3540-141-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/3540-142-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/3540-143-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4824-132-0x00000000005F0000-0x000000000075A000-memory.dmp

Filesize
1.4MB

Download
memory/4824-133-0x00000000056D0000-0x0000000005C74000-memory.dmp

Filesize
5.6MB

Download
memory/4824-134-0x0000000005120000-0x00000000051B2000-memory.dmp

Filesize
584KB

Download
memory/4824-135-0x00000000050F0000-0x00000000050FA000-memory.dmp

Filesize
40KB

Download
memory/4824-136-0x0000000008E30000-0x0000000008ECC000-memory.dmp

Filesize
624KB

Download
memory/4824-137-0x0000000000DF0000-0x0000000000E56000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads