Analysis
-
max time kernel
69s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-02-2023 07:11
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
file.exe
-
Size
1.1MB
-
MD5
9ef762f37d18159788b6f1ddedd432c6
-
SHA1
83349f9a92bba8d297a8bd63b8cebeeae13fc3e8
-
SHA256
0eb87a3705190f81e96901e1376d66657c704915ff88e4ccc954128ba6a7efe0
-
SHA512
e0bc76dc6319cf69e772347d849667aa622d22d601c977f326cd2032b096627921c9fe5fd58844a8348ac417bafd32af03a3d021afd71ab129e9cf0c0b387663
-
SSDEEP
24576:nwJJuwUGkdSemfmmgO59i3LuKR0Zd7lzMdJGrqG4yPas:wJJPlQRkmc5sdu71Usc8
Score
10/10
Malware Config
Signatures
-
Panda Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3480-138-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral2/memory/3480-139-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral2/memory/3480-140-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral2/memory/3480-141-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 3168 set thread context of 3480 3168 file.exe file.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
file.exedescription pid process target process PID 3168 wrote to memory of 3480 3168 file.exe file.exe PID 3168 wrote to memory of 3480 3168 file.exe file.exe PID 3168 wrote to memory of 3480 3168 file.exe file.exe PID 3168 wrote to memory of 3480 3168 file.exe file.exe PID 3168 wrote to memory of 3480 3168 file.exe file.exe PID 3168 wrote to memory of 3480 3168 file.exe file.exe PID 3168 wrote to memory of 3480 3168 file.exe file.exe PID 3168 wrote to memory of 3480 3168 file.exe file.exe PID 3168 wrote to memory of 3480 3168 file.exe file.exe PID 3168 wrote to memory of 3480 3168 file.exe file.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3168-132-0x0000000000550000-0x000000000066E000-memory.dmpFilesize
1.1MB
-
memory/3168-133-0x0000000005530000-0x0000000005AD4000-memory.dmpFilesize
5.6MB
-
memory/3168-134-0x0000000005020000-0x00000000050B2000-memory.dmpFilesize
584KB
-
memory/3168-135-0x0000000005010000-0x000000000501A000-memory.dmpFilesize
40KB
-
memory/3168-136-0x0000000008B40000-0x0000000008BDC000-memory.dmpFilesize
624KB
-
memory/3480-137-0x0000000000000000-mapping.dmp
-
memory/3480-138-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/3480-139-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/3480-140-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/3480-141-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB