pandastealer | 66e9f4eb1c260fa1b7bc83e6554b211523baf67a8e09f9138af2ea8bc1d86cba

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2023 12:01

Target

build_230513_103126.exe
Size

812KB
MD5

9a407b5481db5b6c67a1aa48c753a460
SHA1

9f25c8725dfa140a271851c4f5266518dae8b762
SHA256

66e9f4eb1c260fa1b7bc83e6554b211523baf67a8e09f9138af2ea8bc1d86cba
SHA512

94d227798a2985238e68a3248f81eb63f8b7a8e8f3679298d1a39500d822df6bfa1968d9e24629a04dcf2298da1d2beaa0a11a9bf49fb0f0d10a3232ef0bc279
SSDEEP

12288:d46/NuXgBsdxdDD5Mk/fVI5Jh6opxu1Ue3B4shD1izX1SqrR4xKU4VR/V0f20PZr:y6/NMdtIFXpqU27hD1clr2S0PZzm4

Score

10^/10

Panda Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3640-134-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/3640-141-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Suspicious use of SetThreadContext 1 IoCs

Processes:

build_230513_103126.exe

description pid process target process

PID 4476 set thread context of 3640 4476 build_230513_103126.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4996 4476 WerFault.exe build_230513_103126.exe

description	pid	process	target process
PID 4476 set thread context of 3640	4476	build_230513_103126.exe	AppLaunch.exe

pid	pid_target	process	target process
4996	4476	WerFault.exe	build_230513_103126.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

build_230513_103126.exe

description	pid	process	target process
PID 4476 wrote to memory of 3640	4476	build_230513_103126.exe	AppLaunch.exe
PID 4476 wrote to memory of 3640	4476	build_230513_103126.exe	AppLaunch.exe
PID 4476 wrote to memory of 3640	4476	build_230513_103126.exe	AppLaunch.exe
PID 4476 wrote to memory of 3640	4476	build_230513_103126.exe	AppLaunch.exe
PID 4476 wrote to memory of 3640	4476	build_230513_103126.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
2⤵
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 152
2⤵
- Program crash
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4476 -ip 4476
1⤵
PID:1436

memory/3640-134-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/3640-141-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download