pandastealer | e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336

Analysis

max time kernel
22s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe
Size

5.7MB
MD5

f047eefd6c8d86842e9bc69e66b59889
SHA1

3ccec34545e50611de0d7dcc0a12a0caed02f282
SHA256

e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336
SHA512

e13b01c3282e7aebf731098365bb6d9a7062ad68db039753684f7fdf2b2f6005afec72f912d02bf791c14256ff436fce504f7eb41db26e79fa0e52123c1c6367
SSDEEP

98304:BiGHUsHH4/oSgSYrihBSGiIM9zo5kSg7cZho5H29rvYyVhSj5FefL40SJ:BZ3nawSY2hBSGiH9zo67AhTDYyX40SJ

Score

10^/10

pandastealer spyware stealer vmprotect

Malware Config

Extracted

Family

pandastealer

Version

1.11

http://aaaagay.tbg123123.beget.tech

Signatures

Panda Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1252-54-0x0000000000E60000-0x0000000001809000-memory.dmp	family_pandastealer
behavioral1/memory/1252-58-0x0000000000E60000-0x0000000001809000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1252-54-0x0000000000E60000-0x0000000001809000-memory.dmp	vmprotect
behavioral1/memory/1252-58-0x0000000000E60000-0x0000000001809000-memory.dmp	vmprotect

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe

pid process

1252 e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe

pid	process
1252	e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe
1252	e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe

C:\Users\Admin\AppData\Local\Temp\e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe
"C:\Users\Admin\AppData\Local\Temp\e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1252

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1252-54-0x0000000000E60000-0x0000000001809000-memory.dmp

Filesize
9.7MB

Download
memory/1252-57-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1252-58-0x0000000000E60000-0x0000000001809000-memory.dmp

Filesize
9.7MB

Download