pandastealer | fb3e279923678a38d19ed8711f842e88f4845822b77e05f0d4cf52b05093b161

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 09:31

Target

2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe
Size

26.4MB
MD5

49af26cbbe3fd0f7b13764652501dca2
SHA1

352db76fbfedb374f25f143971c38b4b8915893b
SHA256

fb3e279923678a38d19ed8711f842e88f4845822b77e05f0d4cf52b05093b161
SHA512

7e05310f7d1a1305f280fe80bb6181bb8d7789500d438762b4cb8bd794b720ff9315198fe89ce1623bdcf7bbff2fc25146a3c096f79718523f3716c024d9c0ba
SSDEEP

393216:mqNKqMEAdwPzRwBke2ZYg/LoZ86GfvLDztAmM:rNAEAdw7uke2fLoVGfvLO

Score

10^/10

Panda Stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4980-0-0x0000000000400000-0x000000000048D000-memory.dmp	family_pandastealer
behavioral2/memory/4980-1-0x0000000000400000-0x000000000048D000-memory.dmp	family_pandastealer
behavioral2/memory/4980-2-0x0000000000400000-0x000000000048D000-memory.dmp	family_pandastealer
behavioral2/memory/4980-3-0x0000000000400000-0x000000000048D000-memory.dmp	family_pandastealer
behavioral2/memory/4980-4-0x0000000000400000-0x000000000048D000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Pandastealer family
pandastealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3752 set thread context of 4980	3752	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	91

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 4980	3752	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	91
PID 3752 wrote to memory of 4980	3752	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	91
PID 3752 wrote to memory of 4980	3752	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	91
PID 3752 wrote to memory of 4980	3752	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	91
PID 3752 wrote to memory of 4980	3752	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	91
PID 3752 wrote to memory of 4980	3752	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	91
PID 3752 wrote to memory of 4980	3752	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	91
PID 3752 wrote to memory of 4980	3752	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	91
PID 3752 wrote to memory of 4980	3752	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	91
PID 3752 wrote to memory of 4980	3752	2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-28_49af26cbbe3fd0f7b13764652501dca2_cobalt-strike_ryuk.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\SysWOW64\dxdiag.exe
  "C:\Windows\SysWOW64\dxdiag.exe"
  2⤵
  PID:4980

memory/4980-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4980-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4980-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4980-3-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4980-4-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download