pandastealer | 1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847

Analysis

max time kernel
90s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe
Size

3.1MB
MD5

9be366e3eead805c905977cf03900368
SHA1

2b54c4b41e4cf54beb888bad6b795d9bc0179554
SHA256

1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847
SHA512

d8adccf92392248f5674cc1b69c9533add0913b0307194d41ba78d81b533f57ec4b39e225bd0656441f70214a01cf0a9d64adcf307e06548f0b2f138bc68871f
SSDEEP

12288:u91Gcc3NRaBGsA8jmX+iZ8oruLTrM/5Ri9UMJVFYqon5T28ekRTIGY2jPENs:yc58jmX+iVCTrYRNMJV2o+VYSP5

Score

10^/10

pandastealer stealer

Malware Config

Signatures

Panda Stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/888-134-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/888-135-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/888-136-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/888-137-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

Processes:

1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe

description	pid	process	target process
PID 3612 set thread context of 888	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe

description	pid	process	target process
PID 3612 wrote to memory of 2460	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe
PID 3612 wrote to memory of 2460	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe
PID 3612 wrote to memory of 2460	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe
PID 3612 wrote to memory of 2460	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe
PID 3612 wrote to memory of 888	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe
PID 3612 wrote to memory of 888	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe
PID 3612 wrote to memory of 888	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe
PID 3612 wrote to memory of 888	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe
PID 3612 wrote to memory of 888	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe
PID 3612 wrote to memory of 888	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe
PID 3612 wrote to memory of 888	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe
PID 3612 wrote to memory of 888	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe
PID 3612 wrote to memory of 888	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe
PID 3612 wrote to memory of 888	3612	1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe
"C:\Users\Admin\AppData\Local\Temp\1ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:2460

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/888-133-0x0000000000000000-mapping.dmp

Download
memory/888-134-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/888-135-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/888-136-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/888-137-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2460-132-0x0000000000000000-mapping.dmp

Download