pandastealer | 0666f4e14a01a85d07cd530529b8fdc98883c7506c0f7ab02951d675e5fbe2af

Analysis

max time kernel
10s
max time network
37s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 18:01

Target

0666f4e14a01a85d07cd530529b8fdc98883c7506c0f7ab02951d675e5fbe2af.exe
Size

534KB
MD5

9c228ed564048e4a55675a5f8737343c
SHA1

1372f5eb3f33c2960b0a1ae3e01d171e3544f0ed
SHA256

0666f4e14a01a85d07cd530529b8fdc98883c7506c0f7ab02951d675e5fbe2af
SHA512

ff0629ead32c70fb3707c887ac982de001e630e9ea5a029dacc49b0a57213de0da1da66097612b19e692eb6a4bc4ee1f253fb9339439fcf6bd7e3dd3b25320d0
SSDEEP

12288:jSUh1yUg6NkHp7x/FP1WVCYni/dKP6MJpxGnRbbe:jJh1yS67dLUi/Spxqm

Score

10^/10

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2032	0666f4e14a01a85d07cd530529b8fdc98883c7506c0f7ab02951d675e5fbe2af.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 868	2032	0666f4e14a01a85d07cd530529b8fdc98883c7506c0f7ab02951d675e5fbe2af.exe	30
PID 2032 wrote to memory of 868	2032	0666f4e14a01a85d07cd530529b8fdc98883c7506c0f7ab02951d675e5fbe2af.exe	30
PID 2032 wrote to memory of 868	2032	0666f4e14a01a85d07cd530529b8fdc98883c7506c0f7ab02951d675e5fbe2af.exe	30
PID 2032 wrote to memory of 868	2032	0666f4e14a01a85d07cd530529b8fdc98883c7506c0f7ab02951d675e5fbe2af.exe	30

C:\Users\Admin\AppData\Local\Temp\0666f4e14a01a85d07cd530529b8fdc98883c7506c0f7ab02951d675e5fbe2af.exe
"C:\Users\Admin\AppData\Local\Temp\0666f4e14a01a85d07cd530529b8fdc98883c7506c0f7ab02951d675e5fbe2af.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C Del /f /q "C:\Users\Admin\AppData\Local\Temp\0666f4e14a01a85d07cd530529b8fdc98883c7506c0f7ab02951d675e5fbe2af.exe"
  2⤵
  PID:868

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/2032-54-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download
memory/2032-55-0x0000000000949000-0x00000000009AE000-memory.dmp

Filesize
404KB

Download
memory/2032-56-0x00000000002E0000-0x000000000038E000-memory.dmp

Filesize
696KB

Download
memory/2032-57-0x0000000000400000-0x000000000087F000-memory.dmp

Filesize
4.5MB

Download
memory/2032-59-0x0000000000949000-0x00000000009AE000-memory.dmp

Filesize
404KB

Download
memory/2032-60-0x0000000000400000-0x000000000087F000-memory.dmp

Filesize
4.5MB

Download