pandastealer | 57ad383c47b6423e48e44f750afc38f4e837db3c62eb59e10743d241625259e2

General

Target

9bdffeeb52015df1699b7b0f0aa03cf4.exe
Size

10.9MB
MD5

9bdffeeb52015df1699b7b0f0aa03cf4
SHA1

b9d1f121926acd5a8b146e4675a30d7f8583d2bf
SHA256

57ad383c47b6423e48e44f750afc38f4e837db3c62eb59e10743d241625259e2
SHA512

4e45c2f7ebc96768453340dab5bc29d6a9e998c2c76e424e1af445e13cd89d3b9aafc5233957242fc2dede2e96d35e5cb038b7d3ce6fc47251cc7ca3094875d9
SSDEEP

196608:h5XOsmXgCe4WdIHlJMBJxxviqVVXBgl7ZSr/UyXL23QM2NCfV3d1R9fv7M:jOsmXMeHU9viqeFu8KigMFd1Rm

Score

10^/10

pandastealer spyware stealer vmprotect

Malware Config

Extracted

Family

pandastealer

Version

1.11

C2

http://f0565988.xsph.ru

Signatures

Panda Stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/2792-19-0x0000000000160000-0x0000000000B24000-memory.dmp	family_pandastealer
behavioral1/memory/2792-31-0x0000000000160000-0x0000000000B24000-memory.dmp	family_pandastealer
behavioral1/memory/2792-51-0x0000000000160000-0x0000000000B24000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Executes dropped EXE 1 IoCs

pid	Process
2792	Furios.exe

Loads dropped DLL 4 IoCs

pid	Process
2368	9bdffeeb52015df1699b7b0f0aa03cf4.exe
2368	9bdffeeb52015df1699b7b0f0aa03cf4.exe
2368	9bdffeeb52015df1699b7b0f0aa03cf4.exe
2368	9bdffeeb52015df1699b7b0f0aa03cf4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x0009000000012263-5.dat	vmprotect
behavioral1/files/0x0009000000012263-15.dat	vmprotect
behavioral1/files/0x0009000000012263-12.dat	vmprotect
behavioral1/memory/2792-19-0x0000000000160000-0x0000000000B24000-memory.dmp	vmprotect
behavioral1/memory/2792-31-0x0000000000160000-0x0000000000B24000-memory.dmp	vmprotect
behavioral1/memory/2792-51-0x0000000000160000-0x0000000000B24000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2792	Furios.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2792	Furios.exe
2792	Furios.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2792	2368	9bdffeeb52015df1699b7b0f0aa03cf4.exe	28
PID 2368 wrote to memory of 2792	2368	9bdffeeb52015df1699b7b0f0aa03cf4.exe	28
PID 2368 wrote to memory of 2792	2368	9bdffeeb52015df1699b7b0f0aa03cf4.exe	28
PID 2368 wrote to memory of 2792	2368	9bdffeeb52015df1699b7b0f0aa03cf4.exe	28

C:\Users\Admin\AppData\Local\Temp\9bdffeeb52015df1699b7b0f0aa03cf4.exe
"C:\Users\Admin\AppData\Local\Temp\9bdffeeb52015df1699b7b0f0aa03cf4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\Furios.exe
  "C:\Users\Admin\AppData\Local\Temp\Furios.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Furios.exe

Filesize
5.0MB

MD5
8920b74597608f478fc7fe2134a7cfb0

SHA1
fc3e1ec5168004dd8ec43329e8e697b281eb4b72

SHA256
9a5023b2a29acadd79298c447f80fde5289f7c894c20015e9b957e0c2a95f75d

SHA512
39bdaa0145ad0e639d0659dd2b7161b60f8db06891f3028895f49c42587d9eadb7794d6be61a5756bccc2f0c82a2a3c956a1f78bf05beb5e13548527ff4dd566

Download Submit
\Users\Admin\AppData\Local\Temp\Furios.exe

Filesize
4.5MB

MD5
e42cb0898af0e056a356548cee3b58d2

SHA1
ac8ad573413bb5892e9da066fa2e15058f39f93c

SHA256
5d37e10f87f93d2c4f37e421df9118e6c92ce852992c633d6ad64350bae8c4e8

SHA512
afa7f4522f0e0631ce5312ad7ef2e669e345b2b16cab71b1a7a2a1ca52e76711177096d5d00c4718972a50fc241ec7d88aea507e0d6e3ad2fa54f1b2a1241865

Download Submit
\Users\Admin\AppData\Local\Temp\Furios.exe

Filesize
5.8MB

MD5
df4e68852040ee5abdd047c8d358bcfd

SHA1
b2d077578e9d4326b47d5b2002ea447209e4f32f

SHA256
3c4747711e6ea57f84af33e1676740a0a25f899283ee994cf23fe3aaf55aed59

SHA512
53c888abb92207efe8590b0d7fb790d04681da466bb8d8a0b24548213f3c69d3487f42a4cbcb4eed2ce53b14644af1f6b713a3ea5dff9d05f8cac835ea802b0d

Download Submit
memory/2792-24-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/2792-20-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/2792-22-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/2792-19-0x0000000000160000-0x0000000000B24000-memory.dmp

Filesize
9.8MB

Download
memory/2792-26-0x0000000077660000-0x0000000077661000-memory.dmp

Filesize
4KB

Download
memory/2792-25-0x0000000000C10000-0x0000000000C11000-memory.dmp

Filesize
4KB

Download
memory/2792-28-0x0000000000C10000-0x0000000000C11000-memory.dmp

Filesize
4KB

Download
memory/2792-30-0x0000000000C10000-0x0000000000C11000-memory.dmp

Filesize
4KB

Download
memory/2792-31-0x0000000000160000-0x0000000000B24000-memory.dmp

Filesize
9.8MB

Download
memory/2792-51-0x0000000000160000-0x0000000000B24000-memory.dmp

Filesize
9.8MB

Download

Analysis

Sharing