pandastealer | e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe
Size

5.7MB
MD5

f047eefd6c8d86842e9bc69e66b59889
SHA1

3ccec34545e50611de0d7dcc0a12a0caed02f282
SHA256

e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336
SHA512

e13b01c3282e7aebf731098365bb6d9a7062ad68db039753684f7fdf2b2f6005afec72f912d02bf791c14256ff436fce504f7eb41db26e79fa0e52123c1c6367
SSDEEP

98304:BiGHUsHH4/oSgSYrihBSGiIM9zo5kSg7cZho5H29rvYyVhSj5FefL40SJ:BZ3nawSY2hBSGiH9zo67AhTDYyX40SJ

Score

10^/10

pandastealer spyware stealer vmprotect

Malware Config

Extracted

Family

pandastealer

Version

1.11

http://aaaagay.tbg123123.beget.tech

Signatures

Panda Stealer payload 3 IoCs

resource	yara_rule
behavioral2/memory/488-132-0x0000000000A40000-0x00000000013E9000-memory.dmp	family_pandastealer
behavioral2/memory/488-133-0x0000000000A40000-0x00000000013E9000-memory.dmp	family_pandastealer
behavioral2/memory/488-136-0x0000000000A40000-0x00000000013E9000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/488-132-0x0000000000A40000-0x00000000013E9000-memory.dmp	vmprotect
behavioral2/memory/488-133-0x0000000000A40000-0x00000000013E9000-memory.dmp	vmprotect
behavioral2/memory/488-136-0x0000000000A40000-0x00000000013E9000-memory.dmp	vmprotect

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
488	e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
488	e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe
488	e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe
488	e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe
488	e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe

C:\Users\Admin\AppData\Local\Temp\e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe
"C:\Users\Admin\AppData\Local\Temp\e265876e7f41deaad3ee465d837b94ea7d3e214fa9e2bcfd7bbfe0431c0d5336.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/488-132-0x0000000000A40000-0x00000000013E9000-memory.dmp

Filesize
9.7MB

Download
memory/488-133-0x0000000000A40000-0x00000000013E9000-memory.dmp

Filesize
9.7MB

Download
memory/488-136-0x0000000000A40000-0x00000000013E9000-memory.dmp

Filesize
9.7MB

Download