pandastealer | 8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 19:35

Target

8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe
Size

1.6MB
MD5

bea9c8926c84689fcdbbaa3bfb2ea035
SHA1

6561ed285e4bd2c75c219664c27af51723f96f7c
SHA256

8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a
SHA512

283460f8a6b3cd5275140df6bba69d33bea4f9cfff8cd40c83015f38656fcaab7c2509f78e52884d778a9cc562e25c742ef674c507ce72996d39bfc024f13a2e
SSDEEP

24576:D9JRteWnSwOf1l1cT5PmTmMJ6knr+Vpc1UI/+29:5odf1lKTyptnrApM9

Score

10^/10

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

Processes:

8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe

description	pid	process	target process
PID 4908 set thread context of 5112	4908	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AddInProcess32.exe

pid process

5112 AddInProcess32.exe
5112 AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe

description pid process

Token: SeDebugPrivilege 4908 8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe

pid	process
5112	AddInProcess32.exe
5112	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	4908	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe

description	pid	process	target process
PID 4908 wrote to memory of 3388	4908	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 4908 wrote to memory of 3388	4908	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 4908 wrote to memory of 3388	4908	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 4908 wrote to memory of 5112	4908	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 4908 wrote to memory of 5112	4908	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 4908 wrote to memory of 5112	4908	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 4908 wrote to memory of 5112	4908	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 4908 wrote to memory of 5112	4908	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 4908 wrote to memory of 5112	4908	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 4908 wrote to memory of 5112	4908	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 4908 wrote to memory of 5112	4908	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe
PID 4908 wrote to memory of 5112	4908	8d910617678418648a4e234c803c88cb6ac27059deff6b4831108a11615d473a.exe	AddInProcess32.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:3388

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5112

memory/4908-132-0x00000000004C0000-0x000000000065C000-memory.dmp

Filesize
1.6MB

Download
memory/4908-133-0x00000000055C0000-0x0000000005B64000-memory.dmp

Filesize
5.6MB

Download
memory/4908-134-0x00000000050B0000-0x0000000005142000-memory.dmp

Filesize
584KB

Download
memory/4908-135-0x0000000005030000-0x000000000503A000-memory.dmp

Filesize
40KB

Download
memory/5112-136-0x0000000000000000-mapping.dmp

Download
memory/5112-137-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/5112-138-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/5112-139-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/5112-140-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/5112-141-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/5112-142-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download