Analysis
-
max time kernel
149s -
max time network
57s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
19-07-2020 19:29
Static task
static1
Behavioral task
behavioral1
Sample
pandabanker_2.2.14.vir.exe
Resource
win7v200430
General
-
Target
pandabanker_2.2.14.vir.exe
-
Size
386KB
-
MD5
3453925306c0f929dc8d2ae529cac793
-
SHA1
9bd2acbaa355e5bab33e0e8a112a24da3e623f19
-
SHA256
e8012d5c00deb0a3684d7767de19e4dea2ff536060fe5671393252152b0b1d8f
-
SHA512
57e0b40d6f0584dc72b7a5bed7966ee2d7114e33c4284a92f1af70b4a99e9630b02fbddc58c066eb05b809c9d3905d0101242bd73eb49987f4eb967b21bfe957
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
pandabanker_2.2.14.vir.exedescription pid process Token: SeSecurityPrivilege 892 pandabanker_2.2.14.vir.exe -
Loads dropped DLL 1 IoCs
Processes:
pandabanker_2.2.14.vir.exepid process 892 pandabanker_2.2.14.vir.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
pandabanker_2.2.14.vir.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion pandabanker_2.2.14.vir.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
pandabanker_2.2.14.vir.exepid process 892 pandabanker_2.2.14.vir.exe 892 pandabanker_2.2.14.vir.exe 892 pandabanker_2.2.14.vir.exe 892 pandabanker_2.2.14.vir.exe 892 pandabanker_2.2.14.vir.exe 892 pandabanker_2.2.14.vir.exe 892 pandabanker_2.2.14.vir.exe 892 pandabanker_2.2.14.vir.exe 892 pandabanker_2.2.14.vir.exe 892 pandabanker_2.2.14.vir.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
pandabanker_2.2.14.vir.exe3647222921wleabcEoxlt-eengsairo.exedescription pid process target process PID 892 wrote to memory of 1388 892 pandabanker_2.2.14.vir.exe 3647222921wleabcEoxlt-eengsairo.exe PID 892 wrote to memory of 1388 892 pandabanker_2.2.14.vir.exe 3647222921wleabcEoxlt-eengsairo.exe PID 892 wrote to memory of 1388 892 pandabanker_2.2.14.vir.exe 3647222921wleabcEoxlt-eengsairo.exe PID 892 wrote to memory of 1388 892 pandabanker_2.2.14.vir.exe 3647222921wleabcEoxlt-eengsairo.exe PID 1388 wrote to memory of 1820 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1820 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1820 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1820 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1820 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1820 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1820 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1820 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1772 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1772 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1772 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1772 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1772 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1772 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1772 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 1388 wrote to memory of 1772 1388 3647222921wleabcEoxlt-eengsairo.exe svchost.exe PID 892 wrote to memory of 1768 892 pandabanker_2.2.14.vir.exe cmd.exe PID 892 wrote to memory of 1768 892 pandabanker_2.2.14.vir.exe cmd.exe PID 892 wrote to memory of 1768 892 pandabanker_2.2.14.vir.exe cmd.exe PID 892 wrote to memory of 1768 892 pandabanker_2.2.14.vir.exe cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
3647222921wleabcEoxlt-eengsairo.exepid process 1388 3647222921wleabcEoxlt-eengsairo.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1768 cmd.exe -
Looks for VMWare Tools registry key 2 TTPs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
pandabanker_2.2.14.vir.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\WINE pandabanker_2.2.14.vir.exe Key opened \REGISTRY\MACHINE\Software\Wow6432Node\WINE pandabanker_2.2.14.vir.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.14.vir.exe"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.14.vir.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Identifies Wine through registry keys
-
C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\3647222921wleabcEoxlt-eengsairo.exe"C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\3647222921wleabcEoxlt-eengsairo.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd12f3024c.bat"2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\upd12f3024c.bat
-
C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\3647222921wleabcEoxlt-eengsairo.exe
-
C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\3647222921wleabcEoxlt-eengsairo.exe
-
\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\3647222921wleabcEoxlt-eengsairo.exe
-
memory/892-0-0x0000000013130000-0x0000000013134000-memory.dmpFilesize
16KB
-
memory/892-18-0x0000000002320000-0x0000000002324000-memory.dmpFilesize
16KB
-
memory/1388-6-0x0000000000000000-mapping.dmp
-
memory/1388-8-0x0000000013170000-0x0000000013174000-memory.dmpFilesize
16KB
-
memory/1388-16-0x00000000022A0000-0x00000000022A4000-memory.dmpFilesize
16KB
-
memory/1768-17-0x0000000000000000-mapping.dmp
-
memory/1772-15-0x0000000000000000-mapping.dmp
-
memory/1820-14-0x0000000000000000-mapping.dmp