Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
19-06-2023 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Service64.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
Service64.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
300 seconds
General
-
Target
Service64.exe
-
Size
1.5MB
-
MD5
c845efe0b7345f8a3bcfa5f7a5681b9b
-
SHA1
f603aa58a11dc002161180b401e998ee7c2794ff
-
SHA256
cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4
-
SHA512
ac2478188aa2b57a147a38a0c344c9e3112b89a85d92750de61c267668ee9e6e3e208572456939c70559087d7fb32a8a199471f7a2a0d599b2cd83b9dd7f57dc
-
SSDEEP
24576:/U4bhPbuU5KSnXAW7WFasH3CJkFAsuWyTq+:cYhPFgSnwW5JkFBTf+
Score
10/10
Malware Config
Signatures
-
Panda Stealer payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1632-54-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral1/memory/1632-56-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral1/memory/1632-57-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Service64.exedescription pid process target process PID 1568 set thread context of 1632 1568 Service64.exe InstallUtil.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
Service64.exedescription pid process target process PID 1568 wrote to memory of 1716 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1716 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1716 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1716 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1716 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1716 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1716 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1716 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1632 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1632 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1632 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1632 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1632 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1632 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1632 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1632 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1632 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1632 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1632 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1632 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1632 1568 Service64.exe InstallUtil.exe PID 1568 wrote to memory of 1632 1568 Service64.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Service64.exe"C:\Users\Admin\AppData\Local\Temp\Service64.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:1716
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:1632