pandastealer | ffc30d0aff690cb2ecb49a995fee23daaaa480bb442ed6401451a3dc0f8c1ccd

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06-08-2023 05:45

Target

Service60.exe
Size

2.9MB
MD5

da6044ea382bd3085c2f038f16248fdc
SHA1

709c46e8c5654f257c56ac9c4f0044c7ba36a330
SHA256

ffc30d0aff690cb2ecb49a995fee23daaaa480bb442ed6401451a3dc0f8c1ccd
SHA512

1685d14d4f24115ca5a8c0f9ec6e6f3d7db4bb238df14b2b0f42e836763f521369dcebd8709981e069356a29614868db767c0272d90991db413e0c5654ec2531
SSDEEP

24576:haJkhSY5VDigzPHoGT2gufcmyHHzxMy+xCsJMscr:9SY5VDi2pEcHTJs1c

Score

10^/10

Panda Stealer payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2324-55-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/2508-56-0x00000000011F0000-0x000000000152D000-memory.dmp	family_pandastealer
behavioral1/memory/2324-58-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/2324-59-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/2324-60-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Suspicious use of SetThreadContext 1 IoCs

Processes:

Service60.exe

description pid process target process

PID 2508 set thread context of 2324 2508 Service60.exe InstallUtil.exe

description	pid	process	target process
PID 2508 set thread context of 2324	2508	Service60.exe	InstallUtil.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Service60.exe

description	pid	process	target process
PID 2508 wrote to memory of 2324	2508	Service60.exe	InstallUtil.exe
PID 2508 wrote to memory of 2324	2508	Service60.exe	InstallUtil.exe
PID 2508 wrote to memory of 2324	2508	Service60.exe	InstallUtil.exe
PID 2508 wrote to memory of 2324	2508	Service60.exe	InstallUtil.exe
PID 2508 wrote to memory of 2324	2508	Service60.exe	InstallUtil.exe
PID 2508 wrote to memory of 2324	2508	Service60.exe	InstallUtil.exe
PID 2508 wrote to memory of 2324	2508	Service60.exe	InstallUtil.exe
PID 2508 wrote to memory of 2324	2508	Service60.exe	InstallUtil.exe
PID 2508 wrote to memory of 2324	2508	Service60.exe	InstallUtil.exe
PID 2508 wrote to memory of 2324	2508	Service60.exe	InstallUtil.exe
PID 2508 wrote to memory of 2324	2508	Service60.exe	InstallUtil.exe
PID 2508 wrote to memory of 2324	2508	Service60.exe	InstallUtil.exe
PID 2508 wrote to memory of 2324	2508	Service60.exe	InstallUtil.exe
PID 2508 wrote to memory of 2324	2508	Service60.exe	InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:2324

memory/2324-55-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2324-58-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2324-59-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2324-60-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2508-54-0x00000000011F0000-0x000000000152D000-memory.dmp

Filesize
3.2MB

Download
memory/2508-56-0x00000000011F0000-0x000000000152D000-memory.dmp

Filesize
3.2MB

Download