pandastealer | b71283111aeb6aa2ac4412a61fa71ad3111f4bb961ad2586a60b4b993c2522f3

Analysis

max time kernel
127s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2023 08:58

Target

Service64.exe
Size

2.9MB
MD5

5c2e76ac6e9d7b9a3f0c9c211a721bbb
SHA1

d85d4b80dd7ea8e65819cdaf74c0876ed48cd070
SHA256

b71283111aeb6aa2ac4412a61fa71ad3111f4bb961ad2586a60b4b993c2522f3
SHA512

de443b489dd8d540db8999de984f4e99841828886f7dc7eb25de7a1d006dcc9f8044a86220cb2ab22fba30a66b364068a565db1973da7ff2fafaac7fb1261568
SSDEEP

24576:OSEgfyjmEpIXgxhn+kwnnIl6a9DhvhJhckmZeVCiN1cR45XxhE58tiqxj4lYBk2:OZmEpIXgz+il6a3vkYVxl5Ta8X4KB

Score

10^/10

Panda Stealer payload 6 IoCs

resource	yara_rule
behavioral2/memory/4372-134-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/1540-136-0x0000000000400000-0x0000000000746000-memory.dmp	family_pandastealer
behavioral2/memory/4372-135-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/4372-137-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/4372-138-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer
behavioral2/memory/4372-139-0x0000000000400000-0x00000000004A3000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1540 set thread context of 4372	1540	Service64.exe	81

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 5060	1540	Service64.exe	80
PID 1540 wrote to memory of 5060	1540	Service64.exe	80
PID 1540 wrote to memory of 5060	1540	Service64.exe	80
PID 1540 wrote to memory of 5060	1540	Service64.exe	80
PID 1540 wrote to memory of 4372	1540	Service64.exe	81
PID 1540 wrote to memory of 4372	1540	Service64.exe	81
PID 1540 wrote to memory of 4372	1540	Service64.exe	81
PID 1540 wrote to memory of 4372	1540	Service64.exe	81
PID 1540 wrote to memory of 4372	1540	Service64.exe	81
PID 1540 wrote to memory of 4372	1540	Service64.exe	81
PID 1540 wrote to memory of 4372	1540	Service64.exe	81
PID 1540 wrote to memory of 4372	1540	Service64.exe	81
PID 1540 wrote to memory of 4372	1540	Service64.exe	81
PID 1540 wrote to memory of 4372	1540	Service64.exe	81

C:\Users\Admin\AppData\Local\Temp\Service64.exe
"C:\Users\Admin\AppData\Local\Temp\Service64.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:5060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:4372

memory/1540-133-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1540-136-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/4372-134-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4372-135-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4372-137-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4372-138-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4372-139-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download