pandastealer | 1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c

Analysis

max time kernel
107s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2023 20:18

Target

1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe
Size

1.5MB
MD5

f0d0fefc0b2a3aacccbcc6901fca3530
SHA1

1a9206e75f2b279decb39ed98b830080d773fd01
SHA256

1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c
SHA512

6ac9f229b8d37b34dfd42aa19cc8e9cea53a62ef4ab3d0261815b89829ba5c42d7a0566e4972cb7f7ec72a2be58615c23e9ee5b502e7a3777ab9e0caf1b9257d
SSDEEP

24576:KRsAQ5eoT/iebPRR/usqKBnnBwSRfeyKUY:ksAQ8oLiebZbRnBTGyNY

Score

10^/10

Panda Stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2960-133-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/2960-134-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/2960-135-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/2960-136-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

Processes:

1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe

description	pid	process	target process
PID 4872 set thread context of 2960	4872	1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe	InstallUtil.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe

description	pid	process	target process
PID 4872 wrote to memory of 2960	4872	1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe	InstallUtil.exe
PID 4872 wrote to memory of 2960	4872	1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe	InstallUtil.exe
PID 4872 wrote to memory of 2960	4872	1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe	InstallUtil.exe
PID 4872 wrote to memory of 2960	4872	1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe	InstallUtil.exe
PID 4872 wrote to memory of 2960	4872	1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe	InstallUtil.exe
PID 4872 wrote to memory of 2960	4872	1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe	InstallUtil.exe
PID 4872 wrote to memory of 2960	4872	1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe	InstallUtil.exe
PID 4872 wrote to memory of 2960	4872	1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe	InstallUtil.exe
PID 4872 wrote to memory of 2960	4872	1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe	InstallUtil.exe
PID 4872 wrote to memory of 2960	4872	1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe
"C:\Users\Admin\AppData\Local\Temp\1d3c5be08cb5e52449bc403d4ca2c5697aafb83cb5b883662475d31503442c0c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2960

memory/2960-132-0x0000000000000000-mapping.dmp

Download
memory/2960-133-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2960-134-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2960-135-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2960-136-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download