pandastealer | e49545974370672385b120690b52439884fb33d62891325a7c9aa845fd21d581

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
31-08-2024 00:05

Target

e3009971ab607eccb1c40224df6de209525a0ce8684a46e39b0be864e6a5e755.exe
Size

1.8MB
MD5

34a7d7073e39b9ad09bdca28a9f85dca
SHA1

668bbbf4c7a6f5da498d15b438a1dc397faac400
SHA256

e3009971ab607eccb1c40224df6de209525a0ce8684a46e39b0be864e6a5e755
SHA512

c058cfbfd7d3e99516852ff18b87a39d414fc3c5c6e7e893d56fb61987096ae4569548457cc606f17ba420857bf348f2a45292b2d2189a47aed779c2042104f2
SSDEEP

24576:Mj+rZ7yMOW/GOIXHDfaIuHCAOOxuni/gg0kpOuaWN0bplhNPAN:vygeOIXpcuwuSOu5b

Score

10^/10

Panda Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1972-2-0x000000001A760000-0x000000001A80E000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e3009971ab607eccb1c40224df6de209525a0ce8684a46e39b0be864e6a5e755.exe

description	pid	process	target process
PID 1972 wrote to memory of 2392	1972	e3009971ab607eccb1c40224df6de209525a0ce8684a46e39b0be864e6a5e755.exe	WerFault.exe
PID 1972 wrote to memory of 2392	1972	e3009971ab607eccb1c40224df6de209525a0ce8684a46e39b0be864e6a5e755.exe	WerFault.exe
PID 1972 wrote to memory of 2392	1972	e3009971ab607eccb1c40224df6de209525a0ce8684a46e39b0be864e6a5e755.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e3009971ab607eccb1c40224df6de209525a0ce8684a46e39b0be864e6a5e755.exe
"C:\Users\Admin\AppData\Local\Temp\e3009971ab607eccb1c40224df6de209525a0ce8684a46e39b0be864e6a5e755.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1972 -s 516
2⤵
PID:2392

memory/1972-0-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download
memory/1972-1-0x00000000009A0000-0x0000000000B7E000-memory.dmp

Filesize
1.9MB

Download
memory/1972-2-0x000000001A760000-0x000000001A80E000-memory.dmp

Filesize
696KB

Download
memory/1972-3-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download