Analysis
- max time kernel
150s - max time network
112s - platform
windows10_x64 - resource
win10 - submitted
19/07/2020, 17:23
Static task
static1
Behavioral task
behavioral1
Sample
pandabanker_2.2.9.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
pandabanker_2.2.9.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target pandabanker_2.2.9.vir.exe
- Size 191KB
- Sample200719-9q58pb28ya
- SHA256 7fed42ce016ec6ac5ea6ee1468b1f96afa55955f955471b89bb57c903f0e8fdb
- MD5 e427c35ccfbf9ef9fdc03725a06216a4
- SHA1 6150de4c92beb6a8f07b46d6bae1a227db3f7284
- SHA512 b05ea0c662b686421cf02efd0c0246c52f145107f84b6bb6972f312a56e1a7989c2873c2fb72f728ae1020b66d226f9844a5a092159cd2f4409ec85b5a443bab
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3076 pandabanker_2.2.9.vir.exe 3812 xulstore.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 3076 wrote to memory of 2448 3076 pandabanker_2.2.9.vir.exe 67 PID 3076 wrote to memory of 2448 3076 pandabanker_2.2.9.vir.exe 67 PID 3076 wrote to memory of 2448 3076 pandabanker_2.2.9.vir.exe 67 PID 3076 wrote to memory of 2448 3076 pandabanker_2.2.9.vir.exe 67 PID 3076 wrote to memory of 2448 3076 pandabanker_2.2.9.vir.exe 67 PID 3076 wrote to memory of 2448 3076 pandabanker_2.2.9.vir.exe 67 PID 3076 wrote to memory of 2448 3076 pandabanker_2.2.9.vir.exe 67 PID 3076 wrote to memory of 2448 3076 pandabanker_2.2.9.vir.exe 67 PID 3076 wrote to memory of 2448 3076 pandabanker_2.2.9.vir.exe 67 PID 2448 wrote to memory of 3812 2448 pandabanker_2.2.9.vir.exe 68 PID 2448 wrote to memory of 3812 2448 pandabanker_2.2.9.vir.exe 68 PID 2448 wrote to memory of 3812 2448 pandabanker_2.2.9.vir.exe 68 PID 3812 wrote to memory of 3820 3812 xulstore.exe 69 PID 3812 wrote to memory of 3820 3812 xulstore.exe 69 PID 3812 wrote to memory of 3820 3812 xulstore.exe 69 PID 3812 wrote to memory of 3820 3812 xulstore.exe 69 PID 3812 wrote to memory of 3820 3812 xulstore.exe 69 PID 3812 wrote to memory of 3820 3812 xulstore.exe 69 PID 3812 wrote to memory of 3820 3812 xulstore.exe 69 PID 3812 wrote to memory of 3820 3812 xulstore.exe 69 PID 3812 wrote to memory of 3820 3812 xulstore.exe 69 PID 2448 wrote to memory of 3912 2448 pandabanker_2.2.9.vir.exe 70 PID 2448 wrote to memory of 3912 2448 pandabanker_2.2.9.vir.exe 70 PID 2448 wrote to memory of 3912 2448 pandabanker_2.2.9.vir.exe 70 PID 3820 wrote to memory of 3752 3820 xulstore.exe 71 PID 3820 wrote to memory of 3752 3820 xulstore.exe 71 PID 3820 wrote to memory of 3752 3820 xulstore.exe 71 PID 3820 wrote to memory of 3752 3820 xulstore.exe 71 PID 3820 wrote to memory of 3752 3820 xulstore.exe 71 PID 3820 wrote to memory of 3752 3820 xulstore.exe 71 PID 3820 wrote to memory of 3752 3820 xulstore.exe 71 PID 3820 wrote to memory of 2528 3820 xulstore.exe 73 PID 3820 wrote to memory of 2528 3820 xulstore.exe 73 PID 3820 wrote to memory of 2528 3820 xulstore.exe 73 PID 3820 wrote to memory of 2528 3820 xulstore.exe 73 PID 3820 wrote to memory of 2528 3820 xulstore.exe 73 PID 3820 wrote to memory of 2528 3820 xulstore.exe 73 PID 3820 wrote to memory of 2528 3820 xulstore.exe 73 - Suspicious behavior: EnumeratesProcesses 314 IoCs
pid Process 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 2448 pandabanker_2.2.9.vir.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe 3752 svchost.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion pandabanker_2.2.9.vir.exe - Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\WINE pandabanker_2.2.9.vir.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\WINE pandabanker_2.2.9.vir.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\Currentversion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\xulstore.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\xulstore.exe" svchost.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3076 set thread context of 2448 3076 pandabanker_2.2.9.vir.exe 67 PID 3812 set thread context of 3820 3812 xulstore.exe 69 - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 2448 pandabanker_2.2.9.vir.exe - Executes dropped EXE 2 IoCs
pid Process 3812 xulstore.exe 3820 xulstore.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks for VMWare Tools registry key 2 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.9.vir.exe"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.9.vir.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.9.vir.exe"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.9.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of AdjustPrivilegeToken
PID:2448 -
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\xulstore.exe"C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\xulstore.exe"3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\xulstore.exe"C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\xulstore.exe"4⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:3820 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs5⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
PID:3752
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs5⤵PID:2528
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\updb36aef6d.bat"3⤵PID:3912
-
-