pandastealer | 50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376

Analysis

max time kernel
11s
max time network
38s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/01/2023, 15:19

Target

50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376.exe
Size

5.7MB
MD5

b318c432e7e6baab2d606df72aed7eff
SHA1

4fa94dc9e67d7d27097b4f1699a65767f728eb8d
SHA256

50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376
SHA512

190fad1ac03fff9b5e3270c1442900b43bc2a95ddc34b3969bf82dbb2f63f0f1eced2126d0f3947128fb504154982f48acf2c16e09312c5a3bc6b2cc16f6e5b0
SSDEEP

98304:gi3r5p6X9ns1Os7qxPniZb7Ieiqs9DCRKOypL7SxMeSiyDM/qW:h3ruy/W5niuei/9DCRKOOuxMx+q

Score

10^/10

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1792-54-0x0000000001200000-0x0000000001BA7000-memory.dmp	vmprotect
behavioral1/memory/1792-57-0x0000000001200000-0x0000000001BA7000-memory.dmp	vmprotect
behavioral1/memory/1792-58-0x0000000001200000-0x0000000001BA7000-memory.dmp	vmprotect
behavioral1/memory/1792-60-0x0000000001200000-0x0000000001BA7000-memory.dmp	vmprotect

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1792	50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376.exe

C:\Users\Admin\AppData\Local\Temp\50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376.exe
"C:\Users\Admin\AppData\Local\Temp\50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1792

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1792-54-0x0000000001200000-0x0000000001BA7000-memory.dmp

Filesize
9.7MB

Download
memory/1792-57-0x0000000001200000-0x0000000001BA7000-memory.dmp

Filesize
9.7MB

Download
memory/1792-58-0x0000000001200000-0x0000000001BA7000-memory.dmp

Filesize
9.7MB

Download
memory/1792-59-0x00000000760A1000-0x00000000760A3000-memory.dmp

Filesize
8KB

Download
memory/1792-60-0x0000000001200000-0x0000000001BA7000-memory.dmp

Filesize
9.7MB

Download