pandastealer | cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2023 06:11

Target

cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4.exe
Size

1.5MB
MD5

c845efe0b7345f8a3bcfa5f7a5681b9b
SHA1

f603aa58a11dc002161180b401e998ee7c2794ff
SHA256

cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4
SHA512

ac2478188aa2b57a147a38a0c344c9e3112b89a85d92750de61c267668ee9e6e3e208572456939c70559087d7fb32a8a199471f7a2a0d599b2cd83b9dd7f57dc
SSDEEP

24576:/U4bhPbuU5KSnXAW7WFasH3CJkFAsuWyTq+:cYhPFgSnwW5JkFBTf+

Score

10^/10

Panda Stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/2024-133-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/2024-134-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/2024-135-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/2024-136-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4236 set thread context of 2024	4236	cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4.exe	85

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 2024	4236	cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4.exe	85
PID 4236 wrote to memory of 2024	4236	cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4.exe	85
PID 4236 wrote to memory of 2024	4236	cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4.exe	85
PID 4236 wrote to memory of 2024	4236	cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4.exe	85
PID 4236 wrote to memory of 2024	4236	cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4.exe	85
PID 4236 wrote to memory of 2024	4236	cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4.exe	85
PID 4236 wrote to memory of 2024	4236	cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4.exe	85
PID 4236 wrote to memory of 2024	4236	cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4.exe	85
PID 4236 wrote to memory of 2024	4236	cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4.exe	85
PID 4236 wrote to memory of 2024	4236	cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4.exe	85

C:\Users\Admin\AppData\Local\Temp\cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4.exe
"C:\Users\Admin\AppData\Local\Temp\cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2024

memory/2024-133-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2024-134-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2024-135-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2024-136-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download