pandastealer | 66e9f4eb1c260fa1b7bc83e6554b211523baf67a8e09f9138af2ea8bc1d86cba

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-05-2023 12:05

Target

99242.exe
Size

812KB
MD5

9a407b5481db5b6c67a1aa48c753a460
SHA1

9f25c8725dfa140a271851c4f5266518dae8b762
SHA256

66e9f4eb1c260fa1b7bc83e6554b211523baf67a8e09f9138af2ea8bc1d86cba
SHA512

94d227798a2985238e68a3248f81eb63f8b7a8e8f3679298d1a39500d822df6bfa1968d9e24629a04dcf2298da1d2beaa0a11a9bf49fb0f0d10a3232ef0bc279
SSDEEP

12288:d46/NuXgBsdxdDD5Mk/fVI5Jh6opxu1Ue3B4shD1izX1SqrR4xKU4VR/V0f20PZr:y6/NMdtIFXpqU27hD1clr2S0PZzm4

Score

10^/10

Panda Stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/1744-56-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/1744-64-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/1744-65-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1556 set thread context of 1744	1556	99242.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1100	1556	WerFault.exe	27

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1744	1556	99242.exe	29
PID 1556 wrote to memory of 1744	1556	99242.exe	29
PID 1556 wrote to memory of 1744	1556	99242.exe	29
PID 1556 wrote to memory of 1744	1556	99242.exe	29
PID 1556 wrote to memory of 1744	1556	99242.exe	29
PID 1556 wrote to memory of 1744	1556	99242.exe	29
PID 1556 wrote to memory of 1744	1556	99242.exe	29
PID 1556 wrote to memory of 1744	1556	99242.exe	29
PID 1556 wrote to memory of 1744	1556	99242.exe	29
PID 1556 wrote to memory of 1100	1556	99242.exe	30
PID 1556 wrote to memory of 1100	1556	99242.exe	30
PID 1556 wrote to memory of 1100	1556	99242.exe	30
PID 1556 wrote to memory of 1100	1556	99242.exe	30

C:\Users\Admin\AppData\Local\Temp\99242.exe
"C:\Users\Admin\AppData\Local\Temp\99242.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  PID:1744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 36
  2⤵
  - Program crash
  PID:1100

memory/1744-55-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1744-56-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1744-62-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1744-64-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1744-65-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download