pandastealer | ffc30d0aff690cb2ecb49a995fee23daaaa480bb442ed6401451a3dc0f8c1ccd

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2023 05:45

Target

Service60.exe
Size

2.9MB
MD5

da6044ea382bd3085c2f038f16248fdc
SHA1

709c46e8c5654f257c56ac9c4f0044c7ba36a330
SHA256

ffc30d0aff690cb2ecb49a995fee23daaaa480bb442ed6401451a3dc0f8c1ccd
SHA512

1685d14d4f24115ca5a8c0f9ec6e6f3d7db4bb238df14b2b0f42e836763f521369dcebd8709981e069356a29614868db767c0272d90991db413e0c5654ec2531
SSDEEP

24576:haJkhSY5VDigzPHoGT2gufcmyHHzxMy+xCsJMscr:9SY5VDi2pEcHTJs1c

Score

10^/10

Panda Stealer payload 6 IoCs

resource	yara_rule
behavioral2/memory/4040-134-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/4040-135-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/4040-136-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/3944-137-0x0000000000FE0000-0x000000000131D000-memory.dmp	family_pandastealer
behavioral2/memory/4040-138-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/4040-139-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3944 set thread context of 4040	3944	Service60.exe	84

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 4040	3944	Service60.exe	84
PID 3944 wrote to memory of 4040	3944	Service60.exe	84
PID 3944 wrote to memory of 4040	3944	Service60.exe	84
PID 3944 wrote to memory of 4040	3944	Service60.exe	84
PID 3944 wrote to memory of 4040	3944	Service60.exe	84
PID 3944 wrote to memory of 4040	3944	Service60.exe	84
PID 3944 wrote to memory of 4040	3944	Service60.exe	84
PID 3944 wrote to memory of 4040	3944	Service60.exe	84
PID 3944 wrote to memory of 4040	3944	Service60.exe	84
PID 3944 wrote to memory of 4040	3944	Service60.exe	84

C:\Users\Admin\AppData\Local\Temp\Service60.exe
"C:\Users\Admin\AppData\Local\Temp\Service60.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:4040

memory/3944-133-0x0000000000FE0000-0x000000000131D000-memory.dmp

Filesize
3.2MB

Download
memory/3944-137-0x0000000000FE0000-0x000000000131D000-memory.dmp

Filesize
3.2MB

Download
memory/4040-134-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4040-135-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4040-136-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4040-138-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4040-139-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download