70752b45ccb4a9f987d95097e810b9cbbbfb4141ac35a0b55e55b95c67b022b0

General

Target
pandabanker_2.2.3.vir.exe
Size 286KB
Sample200719-7js342kzge
SHA256 70752b45ccb4a9f987d95097e810b9cbbbfb4141ac35a0b55e55b95c67b022b0
MD5 c1460e75a8f09fbf91371ddd54472997
SHA1 a8dce1910e85bcc182e5c092fa163c7f46381dfa
SHA512 047da421b7093f23309ec917ab2fd1b708c4cb44aebadb0dbe3b60406aedcc525a31c46af63a742b9cb44b3161576a122d8c313d8d76d33f690d608346949b21
MD5 SHA1 SHA512

Score

9^/10

Suspicious behavior: EnumeratesProcesses 20 IoCs

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 3860	3932	pandabanker_2.2.3.vir.exe	67
PID 3932 wrote to memory of 3860	3932	pandabanker_2.2.3.vir.exe	67
PID 3932 wrote to memory of 3860	3932	pandabanker_2.2.3.vir.exe	67
PID 3860 wrote to memory of 3784	3860	1657114595AmcateirvtiSty.exe	73
PID 3860 wrote to memory of 3784	3860	1657114595AmcateirvtiSty.exe	73
PID 3860 wrote to memory of 3784	3860	1657114595AmcateirvtiSty.exe	73
PID 3860 wrote to memory of 3784	3860	1657114595AmcateirvtiSty.exe	73
PID 3860 wrote to memory of 3784	3860	1657114595AmcateirvtiSty.exe	73
PID 3860 wrote to memory of 3784	3860	1657114595AmcateirvtiSty.exe	73
PID 3860 wrote to memory of 3784	3860	1657114595AmcateirvtiSty.exe	73
PID 3860 wrote to memory of 496	3860	1657114595AmcateirvtiSty.exe	75
PID 3860 wrote to memory of 496	3860	1657114595AmcateirvtiSty.exe	75
PID 3860 wrote to memory of 496	3860	1657114595AmcateirvtiSty.exe	75
PID 3860 wrote to memory of 496	3860	1657114595AmcateirvtiSty.exe	75
PID 3860 wrote to memory of 496	3860	1657114595AmcateirvtiSty.exe	75
PID 3860 wrote to memory of 496	3860	1657114595AmcateirvtiSty.exe	75
PID 3860 wrote to memory of 496	3860	1657114595AmcateirvtiSty.exe	75
PID 3932 wrote to memory of 652	3932	pandabanker_2.2.3.vir.exe	76
PID 3932 wrote to memory of 652	3932	pandabanker_2.2.3.vir.exe	76
PID 3932 wrote to memory of 652	3932	pandabanker_2.2.3.vir.exe	76

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pandabanker_2.2.3.vir.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\WINE	pandabanker_2.2.3.vir.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\WINE	pandabanker_2.2.3.vir.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 7 IoCs

Executes dropped EXE 1 IoCs

pid	Process
3860	1657114595AmcateirvtiSty.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.3.vir.exe
"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.3.vir.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of AdjustPrivilegeToken
PID:3932
- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lj62mcv.default-release\datareporting\archived\2020-06\1657114595AmcateirvtiSty.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lj62mcv.default-release\datareporting\archived\2020-06\1657114595AmcateirvtiSty.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Executes dropped EXE
  PID:3860
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:3784
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd30760194.bat"
  2⤵
  PID:652