pandastealer | 0eb87a3705190f81e96901e1376d66657c704915ff88e4ccc954128ba6a7efe0

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-02-2023 07:11

Target

file.exe
Size

1.1MB
MD5

9ef762f37d18159788b6f1ddedd432c6
SHA1

83349f9a92bba8d297a8bd63b8cebeeae13fc3e8
SHA256

0eb87a3705190f81e96901e1376d66657c704915ff88e4ccc954128ba6a7efe0
SHA512

e0bc76dc6319cf69e772347d849667aa622d22d601c977f326cd2032b096627921c9fe5fd58844a8348ac417bafd32af03a3d021afd71ab129e9cf0c0b387663
SSDEEP

24576:nwJJuwUGkdSemfmmgO59i3LuKR0Zd7lzMdJGrqG4yPas:wJJPlQRkmc5sdu71Usc8

Score

10^/10

Panda Stealer payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1672-67-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/1672-68-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/1672-65-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/1672-71-0x000000000045B608-mapping.dmp	family_pandastealer
behavioral1/memory/1672-70-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/1672-74-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/1672-75-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1280 set thread context of 1672 1280 file.exe file.exe

description	pid	process	target process
PID 1280 set thread context of 1672	1280	file.exe	file.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1280 wrote to memory of 1672	1280	file.exe	file.exe
PID 1280 wrote to memory of 1672	1280	file.exe	file.exe
PID 1280 wrote to memory of 1672	1280	file.exe	file.exe
PID 1280 wrote to memory of 1672	1280	file.exe	file.exe
PID 1280 wrote to memory of 1672	1280	file.exe	file.exe
PID 1280 wrote to memory of 1672	1280	file.exe	file.exe
PID 1280 wrote to memory of 1672	1280	file.exe	file.exe
PID 1280 wrote to memory of 1672	1280	file.exe	file.exe
PID 1280 wrote to memory of 1672	1280	file.exe	file.exe
PID 1280 wrote to memory of 1672	1280	file.exe	file.exe
PID 1280 wrote to memory of 1672	1280	file.exe	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
PID:1672

memory/1280-54-0x0000000000880000-0x000000000099E000-memory.dmp

Filesize
1.1MB

Download
memory/1280-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1280-56-0x00000000004C0000-0x00000000004D4000-memory.dmp

Filesize
80KB

Download
memory/1280-57-0x00000000004E0000-0x00000000004EA000-memory.dmp

Filesize
40KB

Download
memory/1280-58-0x0000000007EE0000-0x0000000007FBC000-memory.dmp

Filesize
880KB

Download
memory/1280-59-0x00000000050A0000-0x0000000005144000-memory.dmp

Filesize
656KB

Download
memory/1672-60-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1672-61-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1672-63-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1672-67-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1672-68-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1672-65-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1672-71-0x000000000045B608-mapping.dmp

Download
memory/1672-70-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1672-74-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1672-75-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download