pandastealer | 513b839cea18adfe5cc8f6307dbf2519ab07c6cca7c46508b778150acb88829a

Analysis

max time kernel
80s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2023 08:27

Target

dde995cfb07cbb9bc3f054783cb35461.exe
Size

741KB
MD5

dde995cfb07cbb9bc3f054783cb35461
SHA1

62c8098fd796dbbb1ae38d4e8eaec2bacae64bea
SHA256

513b839cea18adfe5cc8f6307dbf2519ab07c6cca7c46508b778150acb88829a
SHA512

2dcf18699ae9d4a8db786e16a8a450f75dc9de0b5962848250d8c9c0e81ec3eb80efc177794626c1c9971c21306c0a169aff8b9383f8576bc63d1322d568bb25
SSDEEP

12288:s/lF1MbcEK5zByepp5uZpJwPHITFl76WeggtgWwdW1ZdhCEfg7Y1Mh6sP7P3e3:0aIhrpv8GPohoW9gtgDdo/hCEfgTTPu3

Score

10^/10

Panda Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4952-133-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/4952-140-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Suspicious use of SetThreadContext 1 IoCs

Processes:

dde995cfb07cbb9bc3f054783cb35461.exe

description pid process target process

PID 4904 set thread context of 4952 4904 dde995cfb07cbb9bc3f054783cb35461.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4808 4904 WerFault.exe dde995cfb07cbb9bc3f054783cb35461.exe

description	pid	process	target process
PID 4904 set thread context of 4952	4904	dde995cfb07cbb9bc3f054783cb35461.exe	AppLaunch.exe

pid	pid_target	process	target process
4808	4904	WerFault.exe	dde995cfb07cbb9bc3f054783cb35461.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

dde995cfb07cbb9bc3f054783cb35461.exe

description	pid	process	target process
PID 4904 wrote to memory of 4952	4904	dde995cfb07cbb9bc3f054783cb35461.exe	AppLaunch.exe
PID 4904 wrote to memory of 4952	4904	dde995cfb07cbb9bc3f054783cb35461.exe	AppLaunch.exe
PID 4904 wrote to memory of 4952	4904	dde995cfb07cbb9bc3f054783cb35461.exe	AppLaunch.exe
PID 4904 wrote to memory of 4952	4904	dde995cfb07cbb9bc3f054783cb35461.exe	AppLaunch.exe
PID 4904 wrote to memory of 4952	4904	dde995cfb07cbb9bc3f054783cb35461.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\dde995cfb07cbb9bc3f054783cb35461.exe
"C:\Users\Admin\AppData\Local\Temp\dde995cfb07cbb9bc3f054783cb35461.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 488
  2⤵
  - Program crash
  PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4904 -ip 4904
1⤵
PID:4920

memory/4952-132-0x0000000000000000-mapping.dmp

Download
memory/4952-133-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4952-140-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download