pandastealer | 8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a

Analysis

max time kernel
94s
max time network
108s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe
Size

1.6MB
MD5

bea9c8926c84689fcdbbaa3bfb2ea035
SHA1

6561ed285e4bd2c75c219664c27af51723f96f7c
SHA256

8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a
SHA512

283460f8a6b3cd5275140df6bba69d33bea4f9cfff8cd40c83015f38656fcaab7c2509f78e52884d778a9cc562e25c742ef674c507ce72996d39bfc024f13a2e
SSDEEP

24576:D9JRteWnSwOf1l1cT5PmTmMJ6knr+Vpc1UI/+29:5odf1lKTyptnrApM9

Score

10^/10

pandastealer stealer

Malware Config

Signatures

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

Processes:

8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe

description	pid	process	target process
PID 2020 set thread context of 1232	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

AddInProcess32.exe

pid process

1232 AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe

description pid process

Token: SeDebugPrivilege 2020 8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe

pid	process
1232	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe

description	pid	process	target process
PID 2020 wrote to memory of 1208	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 2020 wrote to memory of 1208	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 2020 wrote to memory of 1208	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 2020 wrote to memory of 1208	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 2020 wrote to memory of 1232	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 2020 wrote to memory of 1232	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 2020 wrote to memory of 1232	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 2020 wrote to memory of 1232	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 2020 wrote to memory of 1232	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 2020 wrote to memory of 1232	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 2020 wrote to memory of 1232	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 2020 wrote to memory of 1232	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 2020 wrote to memory of 1232	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 2020 wrote to memory of 1232	2020	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe
"C:\Users\Admin\AppData\Local\Temp\8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:1208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-57-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/1232-58-0x0000000000460E70-mapping.dmp

Download
memory/1232-60-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/1232-61-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/1232-63-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2020-54-0x00000000009D0000-0x0000000000B6C000-memory.dmp

Filesize
1.6MB

Download
memory/2020-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/2020-56-0x0000000004880000-0x000000000489C000-memory.dmp

Filesize
112KB

Download