pandastealer | 66e9f4eb1c260fa1b7bc83e6554b211523baf67a8e09f9138af2ea8bc1d86cba

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-05-2023 12:06

Target

99242.exe
Size

812KB
MD5

9a407b5481db5b6c67a1aa48c753a460
SHA1

9f25c8725dfa140a271851c4f5266518dae8b762
SHA256

66e9f4eb1c260fa1b7bc83e6554b211523baf67a8e09f9138af2ea8bc1d86cba
SHA512

94d227798a2985238e68a3248f81eb63f8b7a8e8f3679298d1a39500d822df6bfa1968d9e24629a04dcf2298da1d2beaa0a11a9bf49fb0f0d10a3232ef0bc279
SSDEEP

12288:d46/NuXgBsdxdDD5Mk/fVI5Jh6opxu1Ue3B4shD1izX1SqrR4xKU4VR/V0f20PZr:y6/NMdtIFXpqU27hD1clr2S0PZzm4

Score

10^/10

Panda Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1708-56-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/1708-64-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/1708-65-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Suspicious use of SetThreadContext 1 IoCs

Processes:

99242.exe

description pid process target process

PID 2036 set thread context of 1708 2036 99242.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1188 2036 WerFault.exe 99242.exe

description	pid	process	target process
PID 2036 set thread context of 1708	2036	99242.exe	AppLaunch.exe

pid	pid_target	process	target process
1188	2036	WerFault.exe	99242.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

99242.exe

description	pid	process	target process
PID 2036 wrote to memory of 1708	2036	99242.exe	AppLaunch.exe
PID 2036 wrote to memory of 1708	2036	99242.exe	AppLaunch.exe
PID 2036 wrote to memory of 1708	2036	99242.exe	AppLaunch.exe
PID 2036 wrote to memory of 1708	2036	99242.exe	AppLaunch.exe
PID 2036 wrote to memory of 1708	2036	99242.exe	AppLaunch.exe
PID 2036 wrote to memory of 1708	2036	99242.exe	AppLaunch.exe
PID 2036 wrote to memory of 1708	2036	99242.exe	AppLaunch.exe
PID 2036 wrote to memory of 1708	2036	99242.exe	AppLaunch.exe
PID 2036 wrote to memory of 1708	2036	99242.exe	AppLaunch.exe
PID 2036 wrote to memory of 1188	2036	99242.exe	WerFault.exe
PID 2036 wrote to memory of 1188	2036	99242.exe	WerFault.exe
PID 2036 wrote to memory of 1188	2036	99242.exe	WerFault.exe
PID 2036 wrote to memory of 1188	2036	99242.exe	WerFault.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
2⤵
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 36
2⤵
- Program crash
PID:1188

memory/1708-55-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1708-56-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1708-62-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1708-64-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1708-65-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download