Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 15:19
Behavioral task
behavioral1
Sample
50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376.exe
Resource
win10v2004-20220812-en
General
-
Target
50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376.exe
-
Size
5.7MB
-
MD5
b318c432e7e6baab2d606df72aed7eff
-
SHA1
4fa94dc9e67d7d27097b4f1699a65767f728eb8d
-
SHA256
50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376
-
SHA512
190fad1ac03fff9b5e3270c1442900b43bc2a95ddc34b3969bf82dbb2f63f0f1eced2126d0f3947128fb504154982f48acf2c16e09312c5a3bc6b2cc16f6e5b0
-
SSDEEP
98304:gi3r5p6X9ns1Os7qxPniZb7Ieiqs9DCRKOypL7SxMeSiyDM/qW:h3ruy/W5niuei/9DCRKOOuxMx+q
Malware Config
Signatures
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Processes:
resource yara_rule behavioral2/memory/1224-132-0x0000000000EA0000-0x0000000001847000-memory.dmp vmprotect behavioral2/memory/1224-135-0x0000000000EA0000-0x0000000001847000-memory.dmp vmprotect behavioral2/memory/1224-136-0x0000000000EA0000-0x0000000001847000-memory.dmp vmprotect behavioral2/memory/1224-137-0x0000000000EA0000-0x0000000001847000-memory.dmp vmprotect -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376.exepid process 1224 50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376.exe 1224 50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1224-132-0x0000000000EA0000-0x0000000001847000-memory.dmpFilesize
9.7MB
-
memory/1224-135-0x0000000000EA0000-0x0000000001847000-memory.dmpFilesize
9.7MB
-
memory/1224-136-0x0000000000EA0000-0x0000000001847000-memory.dmpFilesize
9.7MB
-
memory/1224-137-0x0000000000EA0000-0x0000000001847000-memory.dmpFilesize
9.7MB