pandastealer | 513b839cea18adfe5cc8f6307dbf2519ab07c6cca7c46508b778150acb88829a

Analysis

max time kernel
80s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2023 08:27

Target

dde995cfb07cbb9bc3f054783cb35461.exe
Size

741KB
MD5

dde995cfb07cbb9bc3f054783cb35461
SHA1

62c8098fd796dbbb1ae38d4e8eaec2bacae64bea
SHA256

513b839cea18adfe5cc8f6307dbf2519ab07c6cca7c46508b778150acb88829a
SHA512

2dcf18699ae9d4a8db786e16a8a450f75dc9de0b5962848250d8c9c0e81ec3eb80efc177794626c1c9971c21306c0a169aff8b9383f8576bc63d1322d568bb25
SSDEEP

12288:s/lF1MbcEK5zByepp5uZpJwPHITFl76WeggtgWwdW1ZdhCEfg7Y1Mh6sP7P3e3:0aIhrpv8GPohoW9gtgDdo/hCEfgTTPu3

Score

10^/10

Panda Stealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/4952-133-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/4952-140-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4904 set thread context of 4952	4904	dde995cfb07cbb9bc3f054783cb35461.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4808	4904	WerFault.exe	81

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4952	4904	dde995cfb07cbb9bc3f054783cb35461.exe	83
PID 4904 wrote to memory of 4952	4904	dde995cfb07cbb9bc3f054783cb35461.exe	83
PID 4904 wrote to memory of 4952	4904	dde995cfb07cbb9bc3f054783cb35461.exe	83
PID 4904 wrote to memory of 4952	4904	dde995cfb07cbb9bc3f054783cb35461.exe	83
PID 4904 wrote to memory of 4952	4904	dde995cfb07cbb9bc3f054783cb35461.exe	83

C:\Users\Admin\AppData\Local\Temp\dde995cfb07cbb9bc3f054783cb35461.exe
"C:\Users\Admin\AppData\Local\Temp\dde995cfb07cbb9bc3f054783cb35461.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 488
  2⤵
  - Program crash
  PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4904 -ip 4904
1⤵
PID:4920

memory/4952-133-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4952-140-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download