e8012d5c00deb0a3684d7767de19e4dea2ff536060fe5671393252152b0b1d8f

General

Target
pandabanker_2.2.14.vir.exe
Size 386KB
Sample200719-9qe61psxde
SHA256 e8012d5c00deb0a3684d7767de19e4dea2ff536060fe5671393252152b0b1d8f
MD5 3453925306c0f929dc8d2ae529cac793
SHA1 9bd2acbaa355e5bab33e0e8a112a24da3e623f19
SHA512 57e0b40d6f0584dc72b7a5bed7966ee2d7114e33c4284a92f1af70b4a99e9630b02fbddc58c066eb05b809c9d3905d0101242bd73eb49987f4eb967b21bfe957
MD5 SHA1 SHA512

Score

9^/10

Suspicious behavior: EnumeratesProcesses 20 IoCs

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 1868	972	pandabanker_2.2.14.vir.exe	72
PID 972 wrote to memory of 1868	972	pandabanker_2.2.14.vir.exe	72
PID 972 wrote to memory of 1868	972	pandabanker_2.2.14.vir.exe	72
PID 1868 wrote to memory of 2192	1868	webappsstore.exe	73
PID 1868 wrote to memory of 2192	1868	webappsstore.exe	73
PID 1868 wrote to memory of 2192	1868	webappsstore.exe	73
PID 1868 wrote to memory of 2192	1868	webappsstore.exe	73
PID 1868 wrote to memory of 2192	1868	webappsstore.exe	73
PID 1868 wrote to memory of 2192	1868	webappsstore.exe	73
PID 1868 wrote to memory of 2192	1868	webappsstore.exe	73
PID 1868 wrote to memory of 2540	1868	webappsstore.exe	74
PID 1868 wrote to memory of 2540	1868	webappsstore.exe	74
PID 1868 wrote to memory of 2540	1868	webappsstore.exe	74
PID 1868 wrote to memory of 2540	1868	webappsstore.exe	74
PID 1868 wrote to memory of 2540	1868	webappsstore.exe	74
PID 1868 wrote to memory of 2540	1868	webappsstore.exe	74
PID 1868 wrote to memory of 2540	1868	webappsstore.exe	74
PID 972 wrote to memory of 2788	972	pandabanker_2.2.14.vir.exe	75
PID 972 wrote to memory of 2788	972	pandabanker_2.2.14.vir.exe	75
PID 972 wrote to memory of 2788	972	pandabanker_2.2.14.vir.exe	75

Executes dropped EXE 1 IoCs

pid	Process
1868	webappsstore.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	972	pandabanker_2.2.14.vir.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pandabanker_2.2.14.vir.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\WINE	pandabanker_2.2.14.vir.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\WINE	pandabanker_2.2.14.vir.exe

C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.14.vir.exe
"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.14.vir.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Checks BIOS information in registry
- Identifies Wine through registry keys
PID:972
- C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\webappsstore.exe
  "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\webappsstore.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:1868
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:2540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\updf583c4e3.bat"
  2⤵
  PID:2788