pandastealer | 6bd34841d476beec52a2d0747a4ed50195d82ea77df6d2bcf42041911f945ec6

Analysis

max time kernel
70s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2023 21:27

Target

file.exe
Size

1.3MB
MD5

a25f82f79bbeb8abcf52c7912ebbe2ea
SHA1

939e1b0017a15e77bc7a218a70528b368d8c5212
SHA256

6bd34841d476beec52a2d0747a4ed50195d82ea77df6d2bcf42041911f945ec6
SHA512

9385f1894e02966fc430ae053c2d76b2d8ecd5c870e3f1cdd8f82a2b13c52bbe04a615bd218f0b9aa1d326372c3895cd25aabf485fc3de6d52caccc44515e7d7
SSDEEP

24576:dA3LrxN5IC54TWM7DK2XF9KjmmOhPcBPU+gjhQuH0BvYx4He5xQn7Qym2XS1qN3U:iPtgisnXF9KgdcBcplH0uxZo7Qym1U

Score

10^/10

Panda Stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/736-140-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/736-141-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/736-142-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/736-143-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 2132 set thread context of 736 2132 file.exe file.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

file.exe

pid process

2132 file.exe
2132 file.exe
2132 file.exe
2132 file.exe
2132 file.exe
2132 file.exe
2132 file.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 2132 file.exe

description	pid	process	target process
PID 2132 set thread context of 736	2132	file.exe	file.exe

description	pid	process
Token: SeDebugPrivilege	2132	file.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

file.exe

description	pid	process	target process
PID 2132 wrote to memory of 1772	2132	file.exe	file.exe
PID 2132 wrote to memory of 1772	2132	file.exe	file.exe
PID 2132 wrote to memory of 1772	2132	file.exe	file.exe
PID 2132 wrote to memory of 3468	2132	file.exe	file.exe
PID 2132 wrote to memory of 3468	2132	file.exe	file.exe
PID 2132 wrote to memory of 3468	2132	file.exe	file.exe
PID 2132 wrote to memory of 736	2132	file.exe	file.exe
PID 2132 wrote to memory of 736	2132	file.exe	file.exe
PID 2132 wrote to memory of 736	2132	file.exe	file.exe
PID 2132 wrote to memory of 736	2132	file.exe	file.exe
PID 2132 wrote to memory of 736	2132	file.exe	file.exe
PID 2132 wrote to memory of 736	2132	file.exe	file.exe
PID 2132 wrote to memory of 736	2132	file.exe	file.exe
PID 2132 wrote to memory of 736	2132	file.exe	file.exe
PID 2132 wrote to memory of 736	2132	file.exe	file.exe
PID 2132 wrote to memory of 736	2132	file.exe	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
PID:1772

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
PID:3468

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
PID:736

memory/736-139-0x0000000000000000-mapping.dmp

Download
memory/736-140-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/736-141-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/736-142-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/736-143-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1772-137-0x0000000000000000-mapping.dmp

Download
memory/2132-132-0x00000000006B0000-0x00000000007F8000-memory.dmp

Filesize
1.3MB

Download
memory/2132-133-0x0000000005830000-0x0000000005DD4000-memory.dmp

Filesize
5.6MB

Download
memory/2132-134-0x0000000005420000-0x00000000054B2000-memory.dmp

Filesize
584KB

Download
memory/2132-135-0x0000000005400000-0x000000000540A000-memory.dmp

Filesize
40KB

Download
memory/2132-136-0x0000000009370000-0x000000000940C000-memory.dmp

Filesize
624KB

Download
memory/3468-138-0x0000000000000000-mapping.dmp

Download