Analysis
- max time kernel
151s - max time network
80s - platform
windows7_x64 - resource
win7v200430 - submitted
19/07/2020, 17:23
Static task
static1
Behavioral task
behavioral1
Sample
pandabanker_2.2.9.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
pandabanker_2.2.9.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target pandabanker_2.2.9.vir.exe
- Size 191KB
- Sample200719-9q58pb28ya
- SHA256 7fed42ce016ec6ac5ea6ee1468b1f96afa55955f955471b89bb57c903f0e8fdb
- MD5 e427c35ccfbf9ef9fdc03725a06216a4
- SHA1 6150de4c92beb6a8f07b46d6bae1a227db3f7284
- SHA512 b05ea0c662b686421cf02efd0c0246c52f145107f84b6bb6972f312a56e1a7989c2873c2fb72f728ae1020b66d226f9844a5a092159cd2f4409ec85b5a443bab
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 1068 pandabanker_2.2.9.vir.exe - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion pandabanker_2.2.9.vir.exe - Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\WINE pandabanker_2.2.9.vir.exe Key opened \REGISTRY\MACHINE\Software\Wow6432Node\WINE pandabanker_2.2.9.vir.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1032 pandabanker_2.2.9.vir.exe 1476 sessionstore.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1032 wrote to memory of 1068 1032 pandabanker_2.2.9.vir.exe 24 PID 1032 wrote to memory of 1068 1032 pandabanker_2.2.9.vir.exe 24 PID 1032 wrote to memory of 1068 1032 pandabanker_2.2.9.vir.exe 24 PID 1032 wrote to memory of 1068 1032 pandabanker_2.2.9.vir.exe 24 PID 1032 wrote to memory of 1068 1032 pandabanker_2.2.9.vir.exe 24 PID 1032 wrote to memory of 1068 1032 pandabanker_2.2.9.vir.exe 24 PID 1032 wrote to memory of 1068 1032 pandabanker_2.2.9.vir.exe 24 PID 1032 wrote to memory of 1068 1032 pandabanker_2.2.9.vir.exe 24 PID 1032 wrote to memory of 1068 1032 pandabanker_2.2.9.vir.exe 24 PID 1032 wrote to memory of 1068 1032 pandabanker_2.2.9.vir.exe 24 PID 1068 wrote to memory of 1476 1068 pandabanker_2.2.9.vir.exe 25 PID 1068 wrote to memory of 1476 1068 pandabanker_2.2.9.vir.exe 25 PID 1068 wrote to memory of 1476 1068 pandabanker_2.2.9.vir.exe 25 PID 1068 wrote to memory of 1476 1068 pandabanker_2.2.9.vir.exe 25 PID 1476 wrote to memory of 1776 1476 sessionstore.exe 26 PID 1476 wrote to memory of 1776 1476 sessionstore.exe 26 PID 1476 wrote to memory of 1776 1476 sessionstore.exe 26 PID 1476 wrote to memory of 1776 1476 sessionstore.exe 26 PID 1476 wrote to memory of 1776 1476 sessionstore.exe 26 PID 1476 wrote to memory of 1776 1476 sessionstore.exe 26 PID 1476 wrote to memory of 1776 1476 sessionstore.exe 26 PID 1476 wrote to memory of 1776 1476 sessionstore.exe 26 PID 1476 wrote to memory of 1776 1476 sessionstore.exe 26 PID 1476 wrote to memory of 1776 1476 sessionstore.exe 26 PID 1068 wrote to memory of 1812 1068 pandabanker_2.2.9.vir.exe 28 PID 1068 wrote to memory of 1812 1068 pandabanker_2.2.9.vir.exe 28 PID 1068 wrote to memory of 1812 1068 pandabanker_2.2.9.vir.exe 28 PID 1068 wrote to memory of 1812 1068 pandabanker_2.2.9.vir.exe 28 PID 1776 wrote to memory of 1820 1776 sessionstore.exe 27 PID 1776 wrote to memory of 1820 1776 sessionstore.exe 27 PID 1776 wrote to memory of 1820 1776 sessionstore.exe 27 PID 1776 wrote to memory of 1820 1776 sessionstore.exe 27 PID 1776 wrote to memory of 1820 1776 sessionstore.exe 27 PID 1776 wrote to memory of 1820 1776 sessionstore.exe 27 PID 1776 wrote to memory of 1820 1776 sessionstore.exe 27 PID 1776 wrote to memory of 1820 1776 sessionstore.exe 27 PID 1776 wrote to memory of 1884 1776 sessionstore.exe 30 PID 1776 wrote to memory of 1884 1776 sessionstore.exe 30 PID 1776 wrote to memory of 1884 1776 sessionstore.exe 30 PID 1776 wrote to memory of 1884 1776 sessionstore.exe 30 PID 1776 wrote to memory of 1884 1776 sessionstore.exe 30 PID 1776 wrote to memory of 1884 1776 sessionstore.exe 30 PID 1776 wrote to memory of 1884 1776 sessionstore.exe 30 PID 1776 wrote to memory of 1884 1776 sessionstore.exe 30 - Suspicious behavior: EnumeratesProcesses 298 IoCs
pid Process 1068 pandabanker_2.2.9.vir.exe 1068 pandabanker_2.2.9.vir.exe 1068 pandabanker_2.2.9.vir.exe 1068 pandabanker_2.2.9.vir.exe 1068 pandabanker_2.2.9.vir.exe 1068 pandabanker_2.2.9.vir.exe 1068 pandabanker_2.2.9.vir.exe 1068 pandabanker_2.2.9.vir.exe 1068 pandabanker_2.2.9.vir.exe 1068 pandabanker_2.2.9.vir.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe 1820 svchost.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Loads dropped DLL 2 IoCs
pid Process 1068 pandabanker_2.2.9.vir.exe 1068 pandabanker_2.2.9.vir.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1032 set thread context of 1068 1032 pandabanker_2.2.9.vir.exe 24 PID 1476 set thread context of 1776 1476 sessionstore.exe 26 - Executes dropped EXE 2 IoCs
pid Process 1476 sessionstore.exe 1776 sessionstore.exe - Deletes itself 1 IoCs
pid Process 1812 cmd.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\Currentversion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\sessionstore.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\sessionstore.exe\"" svchost.exe - Looks for VMWare Tools registry key 2 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.9.vir.exe"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.9.vir.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.9.vir.exe"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.9.vir.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\sessionstore.exe"C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\sessionstore.exe"3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\sessionstore.exe"C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\sessionstore.exe"4⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs5⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
PID:1820
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs5⤵PID:1884
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd3591d6be.bat"3⤵
- Deletes itself
PID:1812
-
-