pandastealer | ffc30d0aff690cb2ecb49a995fee23daaaa480bb442ed6401451a3dc0f8c1ccd

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06-08-2023 06:04

Target

Service60.exe
Size

2.9MB
MD5

da6044ea382bd3085c2f038f16248fdc
SHA1

709c46e8c5654f257c56ac9c4f0044c7ba36a330
SHA256

ffc30d0aff690cb2ecb49a995fee23daaaa480bb442ed6401451a3dc0f8c1ccd
SHA512

1685d14d4f24115ca5a8c0f9ec6e6f3d7db4bb238df14b2b0f42e836763f521369dcebd8709981e069356a29614868db767c0272d90991db413e0c5654ec2531
SSDEEP

24576:haJkhSY5VDigzPHoGT2gufcmyHHzxMy+xCsJMscr:9SY5VDi2pEcHTJs1c

Score

10^/10

Panda Stealer payload 5 IoCs

resource	yara_rule
behavioral1/memory/2112-54-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/1972-56-0x0000000000EC0000-0x00000000011FD000-memory.dmp	family_pandastealer
behavioral1/memory/2112-57-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/2112-58-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral1/memory/2112-59-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 2112	1972	Service60.exe	29

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2112	1972	Service60.exe	29
PID 1972 wrote to memory of 2112	1972	Service60.exe	29
PID 1972 wrote to memory of 2112	1972	Service60.exe	29
PID 1972 wrote to memory of 2112	1972	Service60.exe	29
PID 1972 wrote to memory of 2112	1972	Service60.exe	29
PID 1972 wrote to memory of 2112	1972	Service60.exe	29
PID 1972 wrote to memory of 2112	1972	Service60.exe	29
PID 1972 wrote to memory of 2112	1972	Service60.exe	29
PID 1972 wrote to memory of 2112	1972	Service60.exe	29
PID 1972 wrote to memory of 2112	1972	Service60.exe	29
PID 1972 wrote to memory of 2112	1972	Service60.exe	29
PID 1972 wrote to memory of 2112	1972	Service60.exe	29
PID 1972 wrote to memory of 2112	1972	Service60.exe	29
PID 1972 wrote to memory of 2112	1972	Service60.exe	29

C:\Users\Admin\AppData\Local\Temp\Service60.exe
"C:\Users\Admin\AppData\Local\Temp\Service60.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2112

memory/1972-53-0x0000000000EC0000-0x00000000011FD000-memory.dmp

Filesize
3.2MB

Download
memory/1972-56-0x0000000000EC0000-0x00000000011FD000-memory.dmp

Filesize
3.2MB

Download
memory/2112-54-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2112-57-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2112-58-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2112-59-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download