Analysis

  • max time kernel
    137s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2023 06:29

General

  • Target

    c845efe0b7345f8a3bcfa5f7a5681b9b.exe

  • Size

    1.5MB

  • MD5

    c845efe0b7345f8a3bcfa5f7a5681b9b

  • SHA1

    f603aa58a11dc002161180b401e998ee7c2794ff

  • SHA256

    cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4

  • SHA512

    ac2478188aa2b57a147a38a0c344c9e3112b89a85d92750de61c267668ee9e6e3e208572456939c70559087d7fb32a8a199471f7a2a0d599b2cd83b9dd7f57dc

  • SSDEEP

    24576:/U4bhPbuU5KSnXAW7WFasH3CJkFAsuWyTq+:cYhPFgSnwW5JkFBTf+

Score
10/10

Malware Config

Signatures

  • Panda Stealer payload 4 IoCs
  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c845efe0b7345f8a3bcfa5f7a5681b9b.exe
    "C:\Users\Admin\AppData\Local\Temp\c845efe0b7345f8a3bcfa5f7a5681b9b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
        PID:4376

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4376-133-0x0000000000400000-0x00000000004A3000-memory.dmp
      Filesize

      652KB

    • memory/4376-134-0x0000000000400000-0x00000000004A3000-memory.dmp
      Filesize

      652KB

    • memory/4376-135-0x0000000000400000-0x00000000004A3000-memory.dmp
      Filesize

      652KB

    • memory/4376-136-0x0000000000400000-0x00000000004A3000-memory.dmp
      Filesize

      652KB