Analysis
- max time kernel
149s - max time network
124s - platform
windows10_x64 - resource
win10 - submitted
19/07/2020, 19:30
Static task
static1
Behavioral task
behavioral1
Sample
pandabanker_2.5.1.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
pandabanker_2.5.1.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target pandabanker_2.5.1.vir.exe
- Size 98KB
- Sample200719-7smedd1abj
- SHA256 31ed064712da1c70c11c2e157e8469812befb3f051dcd7ffa4de44be49860381
- MD5 203ec0eda28e1fa47e784adeb312f1b7
- SHA1 77170d35b865b04ccb7e22f7814c594ccc205827
- SHA512 f329d53df91985fc551e761d6d5807a802d755a0d1b86d127caf621f5f62b6976645cb9193e7d673a1e3141253e7cfa45cb1f025d30cfee509d0ccc6648a8645
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 720 pandabanker_2.5.1.vir.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 720 wrote to memory of 336 720 pandabanker_2.5.1.vir.exe 67 PID 720 wrote to memory of 336 720 pandabanker_2.5.1.vir.exe 67 PID 720 wrote to memory of 336 720 pandabanker_2.5.1.vir.exe 67 PID 720 wrote to memory of 364 720 pandabanker_2.5.1.vir.exe 68 PID 720 wrote to memory of 364 720 pandabanker_2.5.1.vir.exe 68 PID 720 wrote to memory of 364 720 pandabanker_2.5.1.vir.exe 68 PID 336 wrote to memory of 3932 336 .exe 70 PID 336 wrote to memory of 3932 336 .exe 70 PID 336 wrote to memory of 3932 336 .exe 70 PID 336 wrote to memory of 3932 336 .exe 70 PID 336 wrote to memory of 3932 336 .exe 70 PID 336 wrote to memory of 3932 336 .exe 70 PID 336 wrote to memory of 3932 336 .exe 70 PID 336 wrote to memory of 3892 336 .exe 71 PID 336 wrote to memory of 3892 336 .exe 71 PID 336 wrote to memory of 3892 336 .exe 71 PID 336 wrote to memory of 3892 336 .exe 71 PID 336 wrote to memory of 3892 336 .exe 71 PID 336 wrote to memory of 3892 336 .exe 71 PID 336 wrote to memory of 3892 336 .exe 71 - Executes dropped EXE 1 IoCs
pid Process 336 .exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\Currentversion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\.exe" svchost.exe - Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\WINE pandabanker_2.5.1.vir.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\WINE pandabanker_2.5.1.vir.exe - Suspicious behavior: EnumeratesProcesses 108 IoCs
pid Process 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 720 pandabanker_2.5.1.vir.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe 3932 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pandabanker_2.5.1.vir.exe"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.5.1.vir.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:720 -
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\.exe"C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:336 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3932
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs3⤵PID:3892
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd504943ba.bat"2⤵PID:364
-