pandastealer | a94ffe5bd707888c7a28014793d9e529b77ac4597b7ebb4eabc7cc188407a37d

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86d758c6abd61b00327d4325bc91833b.exe
Size

3.5MB
MD5

86d758c6abd61b00327d4325bc91833b
SHA1

8d732d3a96b61bef222a9852545c1f49eedbcb11
SHA256

a94ffe5bd707888c7a28014793d9e529b77ac4597b7ebb4eabc7cc188407a37d
SHA512

6294d6da0a93f49e3cd83b8e0e65cd2174d4cdcdcc4f1dd85d05c2ab45901427bf2722d6fcf6af3369866bf96862019cbe8112dddf63ad0364752db99dc30b64
SSDEEP

98304:VK6BDjBRP/QsJ2WaYG0rH/ZGKpyjszQYb/qC:VK6ljBd/JghQbZTkjnUqC

Score

10^/10

pandastealer evasion spyware stealer

Malware Config

Signatures

Panda Stealer payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1700-4-0x00000000008C0000-0x00000000010DC000-memory.dmp	family_pandastealer
behavioral1/memory/1700-5-0x00000000008C0000-0x00000000010DC000-memory.dmp	family_pandastealer
behavioral1/memory/1700-6-0x00000000008C0000-0x00000000010DC000-memory.dmp	family_pandastealer
behavioral1/memory/1700-14-0x00000000008C0000-0x00000000010DC000-memory.dmp	family_pandastealer
behavioral1/memory/1700-40-0x00000000008C0000-0x00000000010DC000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

86d758c6abd61b00327d4325bc91833b.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 86d758c6abd61b00327d4325bc91833b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	86d758c6abd61b00327d4325bc91833b.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

86d758c6abd61b00327d4325bc91833b.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	86d758c6abd61b00327d4325bc91833b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	86d758c6abd61b00327d4325bc91833b.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

86d758c6abd61b00327d4325bc91833b.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Wine 86d758c6abd61b00327d4325bc91833b.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

86d758c6abd61b00327d4325bc91833b.exe

pid process

1700 86d758c6abd61b00327d4325bc91833b.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

86d758c6abd61b00327d4325bc91833b.exe

pid process

1700 86d758c6abd61b00327d4325bc91833b.exe
1700 86d758c6abd61b00327d4325bc91833b.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Wine	86d758c6abd61b00327d4325bc91833b.exe

pid	process
1700	86d758c6abd61b00327d4325bc91833b.exe

pid	process
1700	86d758c6abd61b00327d4325bc91833b.exe
1700	86d758c6abd61b00327d4325bc91833b.exe

C:\Users\Admin\AppData\Local\Temp\86d758c6abd61b00327d4325bc91833b.exe
"C:\Users\Admin\AppData\Local\Temp\86d758c6abd61b00327d4325bc91833b.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1700

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-0-0x00000000008C0000-0x00000000010DC000-memory.dmp

Filesize
8.1MB

Download
memory/1700-1-0x00000000008C0000-0x00000000010DC000-memory.dmp

Filesize
8.1MB

Download
memory/1700-2-0x0000000076FD0000-0x0000000076FD2000-memory.dmp

Filesize
8KB

Download
memory/1700-3-0x00000000008C0000-0x00000000010DC000-memory.dmp

Filesize
8.1MB

Download
memory/1700-4-0x00000000008C0000-0x00000000010DC000-memory.dmp

Filesize
8.1MB

Download
memory/1700-5-0x00000000008C0000-0x00000000010DC000-memory.dmp

Filesize
8.1MB

Download
memory/1700-6-0x00000000008C0000-0x00000000010DC000-memory.dmp

Filesize
8.1MB

Download
memory/1700-8-0x00000000027F0000-0x00000000027F1000-memory.dmp

Filesize
4KB

Download
memory/1700-7-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/1700-9-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/1700-12-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1700-11-0x00000000027D0000-0x00000000027D1000-memory.dmp

Filesize
4KB

Download
memory/1700-10-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1700-14-0x00000000008C0000-0x00000000010DC000-memory.dmp

Filesize
8.1MB

Download
memory/1700-19-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1700-24-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/1700-26-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/1700-29-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1700-32-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/1700-31-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1700-30-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1700-28-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1700-27-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1700-25-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1700-23-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/1700-22-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download
memory/1700-40-0x00000000008C0000-0x00000000010DC000-memory.dmp

Filesize
8.1MB

Download