pandastealer | fb3e279923678a38d19ed8711f842e88f4845822b77e05f0d4cf52b05093b161

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-11-2024 09:25

Target

2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe
Size

26.4MB
MD5

49af26cbbe3fd0f7b13764652501dca2
SHA1

352db76fbfedb374f25f143971c38b4b8915893b
SHA256

fb3e279923678a38d19ed8711f842e88f4845822b77e05f0d4cf52b05093b161
SHA512

7e05310f7d1a1305f280fe80bb6181bb8d7789500d438762b4cb8bd794b720ff9315198fe89ce1623bdcf7bbff2fc25146a3c096f79718523f3716c024d9c0ba
SSDEEP

393216:mqNKqMEAdwPzRwBke2ZYg/LoZ86GfvLDztAmM:rNAEAdw7uke2fLoVGfvLO

Score

10^/10

Panda Stealer payload 7 IoCs

resource	yara_rule
behavioral1/memory/1480-5-0x0000000000400000-0x000000000048D000-memory.dmp	family_pandastealer
behavioral1/memory/1480-10-0x0000000000400000-0x000000000048D000-memory.dmp	family_pandastealer
behavioral1/memory/1480-9-0x0000000000400000-0x000000000048D000-memory.dmp	family_pandastealer
behavioral1/memory/1480-7-0x0000000000400000-0x000000000048D000-memory.dmp	family_pandastealer
behavioral1/memory/1480-4-0x0000000000400000-0x000000000048D000-memory.dmp	family_pandastealer
behavioral1/memory/1480-3-0x0000000000400000-0x000000000048D000-memory.dmp	family_pandastealer
behavioral1/memory/1480-11-0x0000000000400000-0x000000000048D000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Pandastealer family
pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 1480	1628	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1480	1628	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	31
PID 1628 wrote to memory of 1480	1628	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	31
PID 1628 wrote to memory of 1480	1628	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	31
PID 1628 wrote to memory of 1480	1628	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	31
PID 1628 wrote to memory of 1480	1628	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	31
PID 1628 wrote to memory of 1480	1628	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	31
PID 1628 wrote to memory of 1480	1628	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	31
PID 1628 wrote to memory of 1480	1628	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	31
PID 1628 wrote to memory of 1480	1628	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	31
PID 1628 wrote to memory of 1480	1628	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	31
PID 1628 wrote to memory of 1480	1628	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\dxdiag.exe
  "C:\Windows\SysWOW64\dxdiag.exe"
  2⤵
  PID:1480

memory/1480-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1480-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1480-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1480-5-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1480-10-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1480-9-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1480-7-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1480-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1480-4-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1480-3-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1480-11-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download