Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    07-01-2024 12:12

General

  • Target

    48f28d22c6daf1c2ccf274a4e40d71c4.exe

  • Size

    1.3MB

  • MD5

    48f28d22c6daf1c2ccf274a4e40d71c4

  • SHA1

    b5ca1737a9846ba2bd4e86093d5a7e6a242eac54

  • SHA256

    e13a607d79c405ea8a8204e0a89dc5342f48f6aafc3185f414fcc558c5c7e5c8

  • SHA512

    d24d04a48690fe889ec66ebb9690c7ea4787142963a8a3704b047cdae69b6c19b8aa9193ac74f503589236d522bf562bdda7e26f7943f670745498d9312a1545

  • SSDEEP

    24576:PsfIM4TnX1jiRgkzfF4iNj2QljuaSMJbbE7QFxJBZLaAnIePB0oWwXm:PswMeXqggH6IqdM1bQGxJLa4R0

Score
10/10

Malware Config

Extracted

Family

pandastealer

Version

1.11

C2

http://f0565122.xsph.ru

Signatures

  • Panda Stealer payload 2 IoCs
  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48f28d22c6daf1c2ccf274a4e40d71c4.exe
    "C:\Users\Admin\AppData\Local\Temp\48f28d22c6daf1c2ccf274a4e40d71c4.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/780-0-0x0000000000920000-0x0000000000C82000-memory.dmp

    Filesize

    3.4MB

  • memory/780-1-0x0000000000920000-0x0000000000C82000-memory.dmp

    Filesize

    3.4MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.