Analysis
- max time kernel
149s - max time network
118s - platform
windows10_x64 - resource
win10 - submitted
19/07/2020, 19:45
Static task
static1
Behavioral task
behavioral1
Sample
pandabanker_2.6.2.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
pandabanker_2.6.2.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target pandabanker_2.6.2.vir.exe
- Size 92KB
- Sample200719-2rt8agpbd6
- SHA256 94c1b963cc2b06ec91490e557ded99ecfc04d336eea26fdb2f4253a0cfa3ed81
- MD5 35759acd799f951b8beef86311bd9b77
- SHA1 835e0b085afe038d013b2bd1675a1dd6b89c9949
- SHA512 f06c2e33e947b3a24e368b30b9f129007c247b6b08ffe324fb3a34a004e9fa9c9edb426a4cbbd423a76a1eeba054d062d0a8eae87752416987d165bbc6511fa6
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3896 favicons.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\Currentversion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\favicons.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\favicons.exe" svchost.exe - Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\WINE pandabanker_2.6.2.vir.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\WINE pandabanker_2.6.2.vir.exe - Suspicious behavior: EnumeratesProcesses 316 IoCs
pid Process 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3100 pandabanker_2.6.2.vir.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe 3324 svchost.exe 3324 svchost.exe 3928 svchost.exe 3928 svchost.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 3100 pandabanker_2.6.2.vir.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3100 wrote to memory of 3896 3100 pandabanker_2.6.2.vir.exe 67 PID 3100 wrote to memory of 3896 3100 pandabanker_2.6.2.vir.exe 67 PID 3100 wrote to memory of 3896 3100 pandabanker_2.6.2.vir.exe 67 PID 3896 wrote to memory of 3324 3896 favicons.exe 68 PID 3896 wrote to memory of 3324 3896 favicons.exe 68 PID 3896 wrote to memory of 3324 3896 favicons.exe 68 PID 3100 wrote to memory of 3312 3100 pandabanker_2.6.2.vir.exe 69 PID 3100 wrote to memory of 3312 3100 pandabanker_2.6.2.vir.exe 69 PID 3100 wrote to memory of 3312 3100 pandabanker_2.6.2.vir.exe 69 PID 3896 wrote to memory of 3324 3896 favicons.exe 68 PID 3896 wrote to memory of 3324 3896 favicons.exe 68 PID 3896 wrote to memory of 3324 3896 favicons.exe 68 PID 3896 wrote to memory of 3324 3896 favicons.exe 68 PID 3896 wrote to memory of 3928 3896 favicons.exe 71 PID 3896 wrote to memory of 3928 3896 favicons.exe 71 PID 3896 wrote to memory of 3928 3896 favicons.exe 71 PID 3896 wrote to memory of 3928 3896 favicons.exe 71 PID 3896 wrote to memory of 3928 3896 favicons.exe 71 PID 3896 wrote to memory of 3928 3896 favicons.exe 71 PID 3896 wrote to memory of 3928 3896 favicons.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\pandabanker_2.6.2.vir.exe"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.6.2.vir.exe"1⤵
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\favicons.exe"C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\favicons.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3324
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3928
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd29d8af9b.bat"2⤵PID:3312
-