be4a4c076d2644bb29e90d6dc42ce9f400a940a9d684fd9073abdca0b65c9bca

General

Target
pandabanker_2.1.3.vir.exe
Size 213KB
Sample200719-46gh54516e
SHA256 be4a4c076d2644bb29e90d6dc42ce9f400a940a9d684fd9073abdca0b65c9bca
MD5 01549ffc7c4dd015b2c01590536d2f9a
SHA1 df6734c99e5a682c1298b983b3b2727d2853770d
SHA512 113b5adca2923add218647df6afdef4f92317699a365522e53d8e97cf843a2b81262efad7d749168d3d29b6f5835f086aa2ef53e1f9c2a8e9c768dea76de04f0
MD5 SHA1 SHA512

Score

8^/10

spyware

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2804	pandabanker_2.1.3.vir.exe
2804	pandabanker_2.1.3.vir.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2780	shield-preference-experiments.exe
2780	shield-preference-experiments.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe
3904	WerFault.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2592	2804	WerFault.exe	65
3896	2804	WerFault.exe	65
4048	2804	WerFault.exe	65
3904	2780	WerFault.exe	74
3324	2780	WerFault.exe	74
3548	2804	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	2592	WerFault.exe
Token: SeBackupPrivilege	2592	WerFault.exe
Token: SeDebugPrivilege	2592	WerFault.exe
Token: SeSecurityPrivilege	2804	pandabanker_2.1.3.vir.exe
Token: SeSecurityPrivilege	2804	pandabanker_2.1.3.vir.exe
Token: SeDebugPrivilege	3904	WerFault.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2780	2804	pandabanker_2.1.3.vir.exe	74
PID 2804 wrote to memory of 2780	2804	pandabanker_2.1.3.vir.exe	74
PID 2804 wrote to memory of 2780	2804	pandabanker_2.1.3.vir.exe	74
PID 2780 wrote to memory of 4024	2780	shield-preference-experiments.exe	78
PID 2780 wrote to memory of 4024	2780	shield-preference-experiments.exe	78
PID 2780 wrote to memory of 4024	2780	shield-preference-experiments.exe	78
PID 2780 wrote to memory of 4024	2780	shield-preference-experiments.exe	78
PID 2780 wrote to memory of 4024	2780	shield-preference-experiments.exe	78
PID 2780 wrote to memory of 4024	2780	shield-preference-experiments.exe	78
PID 2780 wrote to memory of 4024	2780	shield-preference-experiments.exe	78
PID 2780 wrote to memory of 3820	2780	shield-preference-experiments.exe	79
PID 2780 wrote to memory of 3820	2780	shield-preference-experiments.exe	79
PID 2780 wrote to memory of 3820	2780	shield-preference-experiments.exe	79
PID 2780 wrote to memory of 3820	2780	shield-preference-experiments.exe	79
PID 2780 wrote to memory of 3820	2780	shield-preference-experiments.exe	79
PID 2780 wrote to memory of 3820	2780	shield-preference-experiments.exe	79
PID 2780 wrote to memory of 3820	2780	shield-preference-experiments.exe	79
PID 2804 wrote to memory of 2328	2804	pandabanker_2.1.3.vir.exe	81
PID 2804 wrote to memory of 2328	2804	pandabanker_2.1.3.vir.exe	81
PID 2804 wrote to memory of 2328	2804	pandabanker_2.1.3.vir.exe	81

Executes dropped EXE 1 IoCs

pid	Process
2780	shield-preference-experiments.exe

C:\Users\Admin\AppData\Local\Temp\pandabanker_2.1.3.vir.exe
"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.1.3.vir.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 580
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ah406040.default-release\storage\shield-preference-experiments.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ah406040.default-release\storage\shield-preference-experiments.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:2780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 584
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:4024
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 280
    3⤵
    - Program crash
    PID:3324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 764
  2⤵
  - Program crash
  PID:3896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 776
  2⤵
  - Program crash
  PID:4048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\updbc04ca14.bat"
  2⤵
  PID:2328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 272
  2⤵
  - Program crash
  PID:3548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2592-0-0x0000000005060000-0x0000000005061000-memory.dmp

Download

memory/2592-1-0x0000000005690000-0x0000000005691000-memory.dmp

Download

memory/3904-8-0x00000000054E0000-0x00000000054E1000-memory.dmp

Download

memory/3904-5-0x0000000004E30000-0x0000000004E31000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads