pandastealer | 66e9f4eb1c260fa1b7bc83e6554b211523baf67a8e09f9138af2ea8bc1d86cba

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2023 12:01

Target

build_230513_103126.exe
Size

812KB
MD5

9a407b5481db5b6c67a1aa48c753a460
SHA1

9f25c8725dfa140a271851c4f5266518dae8b762
SHA256

66e9f4eb1c260fa1b7bc83e6554b211523baf67a8e09f9138af2ea8bc1d86cba
SHA512

94d227798a2985238e68a3248f81eb63f8b7a8e8f3679298d1a39500d822df6bfa1968d9e24629a04dcf2298da1d2beaa0a11a9bf49fb0f0d10a3232ef0bc279
SSDEEP

12288:d46/NuXgBsdxdDD5Mk/fVI5Jh6opxu1Ue3B4shD1izX1SqrR4xKU4VR/V0f20PZr:y6/NMdtIFXpqU27hD1clr2S0PZzm4

Score

10^/10

Panda Stealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/3640-134-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/3640-141-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4476 set thread context of 3640	4476	build_230513_103126.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4996	4476	WerFault.exe	84

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3640	4476	build_230513_103126.exe	86
PID 4476 wrote to memory of 3640	4476	build_230513_103126.exe	86
PID 4476 wrote to memory of 3640	4476	build_230513_103126.exe	86
PID 4476 wrote to memory of 3640	4476	build_230513_103126.exe	86
PID 4476 wrote to memory of 3640	4476	build_230513_103126.exe	86

C:\Users\Admin\AppData\Local\Temp\build_230513_103126.exe
"C:\Users\Admin\AppData\Local\Temp\build_230513_103126.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  PID:3640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 152
  2⤵
  - Program crash
  PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4476 -ip 4476
1⤵
PID:1436

memory/3640-134-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/3640-141-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download