pandastealer | 66e9f4eb1c260fa1b7bc83e6554b211523baf67a8e09f9138af2ea8bc1d86cba

Analysis

max time kernel
110s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2023 12:06

Target

99242.exe
Size

812KB
MD5

9a407b5481db5b6c67a1aa48c753a460
SHA1

9f25c8725dfa140a271851c4f5266518dae8b762
SHA256

66e9f4eb1c260fa1b7bc83e6554b211523baf67a8e09f9138af2ea8bc1d86cba
SHA512

94d227798a2985238e68a3248f81eb63f8b7a8e8f3679298d1a39500d822df6bfa1968d9e24629a04dcf2298da1d2beaa0a11a9bf49fb0f0d10a3232ef0bc279
SSDEEP

12288:d46/NuXgBsdxdDD5Mk/fVI5Jh6opxu1Ue3B4shD1izX1SqrR4xKU4VR/V0f20PZr:y6/NMdtIFXpqU27hD1clr2S0PZzm4

Score

10^/10

Panda Stealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/960-134-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/960-141-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5036 set thread context of 960	5036	99242.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	5036	WerFault.exe	83

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 960	5036	99242.exe	85
PID 5036 wrote to memory of 960	5036	99242.exe	85
PID 5036 wrote to memory of 960	5036	99242.exe	85
PID 5036 wrote to memory of 960	5036	99242.exe	85
PID 5036 wrote to memory of 960	5036	99242.exe	85

C:\Users\Admin\AppData\Local\Temp\99242.exe
"C:\Users\Admin\AppData\Local\Temp\99242.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  PID:960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 492
  2⤵
  - Program crash
  PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5036 -ip 5036
1⤵
PID:4716

memory/960-134-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/960-141-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download