pandastealer | aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c

Analysis

max time kernel
55s
max time network
58s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
20-06-2023 12:05

Target

aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c.exe
Size

1.5MB
MD5

49704b97bcd887168cb9e8250a9290c7
SHA1

50433133a3323c91710cc365f634db38a9f32149
SHA256

aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c
SHA512

093760862c7f0d539bb1cac070ba064686fc0d5e9f9cb30e44b3b93f049ceaa2151f7031ae172679a7d7703b00994b9c88580ee0b21d782958acb0f3f991607f
SSDEEP

24576:YZlyh1HJT+lngCxljAfbecOnuOSpU2h+5:0EhZJCfxCjwuOSpUG+5

Score

10^/10

Panda Stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/3640-121-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/3640-122-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/3640-123-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/3640-124-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4208 set thread context of 3640	4208	aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c.exe	67

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 3640	4208	aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c.exe	67
PID 4208 wrote to memory of 3640	4208	aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c.exe	67
PID 4208 wrote to memory of 3640	4208	aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c.exe	67
PID 4208 wrote to memory of 3640	4208	aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c.exe	67
PID 4208 wrote to memory of 3640	4208	aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c.exe	67
PID 4208 wrote to memory of 3640	4208	aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c.exe	67
PID 4208 wrote to memory of 3640	4208	aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c.exe	67
PID 4208 wrote to memory of 3640	4208	aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c.exe	67
PID 4208 wrote to memory of 3640	4208	aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c.exe	67
PID 4208 wrote to memory of 3640	4208	aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c.exe	67

C:\Users\Admin\AppData\Local\Temp\aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c.exe
"C:\Users\Admin\AppData\Local\Temp\aaab57a63cc2c75879c5a11dfb890ac554a87bf23bd76bda8cadd7f49ff0505c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:3640

memory/3640-121-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/3640-122-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/3640-123-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/3640-124-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download