70752b45ccb4a9f987d95097e810b9cbbbfb4141ac35a0b55e55b95c67b022b0

General

Target
pandabanker_2.2.3.vir.exe
Size 286KB
Sample200719-7js342kzge
SHA256 70752b45ccb4a9f987d95097e810b9cbbbfb4141ac35a0b55e55b95c67b022b0
MD5 c1460e75a8f09fbf91371ddd54472997
SHA1 a8dce1910e85bcc182e5c092fa163c7f46381dfa
SHA512 047da421b7093f23309ec917ab2fd1b708c4cb44aebadb0dbe3b60406aedcc525a31c46af63a742b9cb44b3161576a122d8c313d8d76d33f690d608346949b21
MD5 SHA1 SHA512

Score

9^/10

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 316	900	pandabanker_2.2.3.vir.exe	24
PID 900 wrote to memory of 316	900	pandabanker_2.2.3.vir.exe	24
PID 900 wrote to memory of 316	900	pandabanker_2.2.3.vir.exe	24
PID 900 wrote to memory of 316	900	pandabanker_2.2.3.vir.exe	24
PID 316 wrote to memory of 1856	316	.exe	27
PID 316 wrote to memory of 1856	316	.exe	27
PID 316 wrote to memory of 1856	316	.exe	27
PID 316 wrote to memory of 1856	316	.exe	27
PID 316 wrote to memory of 1856	316	.exe	27
PID 316 wrote to memory of 1856	316	.exe	27
PID 316 wrote to memory of 1856	316	.exe	27
PID 316 wrote to memory of 1856	316	.exe	27
PID 316 wrote to memory of 1780	316	.exe	28
PID 316 wrote to memory of 1780	316	.exe	28
PID 316 wrote to memory of 1780	316	.exe	28
PID 316 wrote to memory of 1780	316	.exe	28
PID 316 wrote to memory of 1780	316	.exe	28
PID 316 wrote to memory of 1780	316	.exe	28
PID 316 wrote to memory of 1780	316	.exe	28
PID 316 wrote to memory of 1780	316	.exe	28
PID 900 wrote to memory of 1228	900	pandabanker_2.2.3.vir.exe	29
PID 900 wrote to memory of 1228	900	pandabanker_2.2.3.vir.exe	29
PID 900 wrote to memory of 1228	900	pandabanker_2.2.3.vir.exe	29
PID 900 wrote to memory of 1228	900	pandabanker_2.2.3.vir.exe	29

Deletes itself 1 IoCs

pid	Process
1228	cmd.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\WINE	pandabanker_2.2.3.vir.exe
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\WINE	pandabanker_2.2.3.vir.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Suspicious use of AdjustPrivilegeToken 7 IoCs

Loads dropped DLL 1 IoCs

pid	Process
900	pandabanker_2.2.3.vir.exe

Executes dropped EXE 1 IoCs

pid	Process
316	.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pandabanker_2.2.3.vir.exe

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Suspicious behavior: EnumeratesProcesses 10 IoCs

C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.3.vir.exe
"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.3.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Identifies Wine through registry keys
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
PID:900
- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d5vrebxd.default-release\datareporting\archived\2020-06\.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d5vrebxd.default-release\datareporting\archived\2020-06\.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Executes dropped EXE
  PID:316
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:1856
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:1780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd05cc30a5.bat"
  2⤵
  - Deletes itself
  PID:1228