pandastealer | 78d000e956e517b7ac492a482162b1967e80efa72a8a77023dae832c0cd3a554

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b3365e1fe3a0b940f1fbd075a3c0cc7.exe
Size

5.1MB
MD5

8b3365e1fe3a0b940f1fbd075a3c0cc7
SHA1

7d3659c80dd811d564aa86e3d14d0cae27b4c84d
SHA256

78d000e956e517b7ac492a482162b1967e80efa72a8a77023dae832c0cd3a554
SHA512

01ea3dc7e4e43c6fbb64184610d1bcb733b8db56da2189bc2712e5a3e7bfdc873b950f1b0145069063981038126bafad6babd365cc3611af164d40f3600f0bc8
SSDEEP

98304:FN8fdIXOm6fJIVpTR0Q/tMcYqV646hEab1x+JCod1E35TxIvRM:D8qyIVdRCcYqV6/Bx+4NJVIu

Score

10^/10

pandastealer spyware stealer vmprotect

Malware Config

Extracted

Family

pandastealer

Version

1.11

http://f0565284.xsph.ru

Signatures

Panda Stealer payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000400000-0x0000000000C95000-memory.dmp	family_pandastealer
behavioral1/memory/3044-3-0x0000000000400000-0x0000000000C95000-memory.dmp	family_pandastealer
behavioral1/memory/3044-13-0x0000000000400000-0x0000000000C95000-memory.dmp	family_pandastealer
behavioral1/memory/3044-31-0x0000000000400000-0x0000000000C95000-memory.dmp	family_pandastealer
behavioral1/memory/3044-35-0x0000000000400000-0x0000000000C95000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000400000-0x0000000000C95000-memory.dmp	vmprotect
behavioral1/memory/3044-3-0x0000000000400000-0x0000000000C95000-memory.dmp	vmprotect
behavioral1/memory/3044-13-0x0000000000400000-0x0000000000C95000-memory.dmp	vmprotect
behavioral1/memory/3044-31-0x0000000000400000-0x0000000000C95000-memory.dmp	vmprotect
behavioral1/memory/3044-35-0x0000000000400000-0x0000000000C95000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

8b3365e1fe3a0b940f1fbd075a3c0cc7.exe

pid process

3044 8b3365e1fe3a0b940f1fbd075a3c0cc7.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

8b3365e1fe3a0b940f1fbd075a3c0cc7.exe

pid process

3044 8b3365e1fe3a0b940f1fbd075a3c0cc7.exe
3044 8b3365e1fe3a0b940f1fbd075a3c0cc7.exe

pid	process
3044	8b3365e1fe3a0b940f1fbd075a3c0cc7.exe

pid	process
3044	8b3365e1fe3a0b940f1fbd075a3c0cc7.exe
3044	8b3365e1fe3a0b940f1fbd075a3c0cc7.exe

C:\Users\Admin\AppData\Local\Temp\8b3365e1fe3a0b940f1fbd075a3c0cc7.exe
"C:\Users\Admin\AppData\Local\Temp\8b3365e1fe3a0b940f1fbd075a3c0cc7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3044

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x0000000000400000-0x0000000000C95000-memory.dmp

Filesize
8.6MB

Download
memory/3044-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3044-3-0x0000000000400000-0x0000000000C95000-memory.dmp

Filesize
8.6MB

Download
memory/3044-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3044-6-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3044-10-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3044-8-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3044-7-0x0000000077060000-0x0000000077061000-memory.dmp

Filesize
4KB

Download
memory/3044-12-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3044-13-0x0000000000400000-0x0000000000C95000-memory.dmp

Filesize
8.6MB

Download
memory/3044-31-0x0000000000400000-0x0000000000C95000-memory.dmp

Filesize
8.6MB

Download
memory/3044-35-0x0000000000400000-0x0000000000C95000-memory.dmp

Filesize
8.6MB

Download