a6214596a7509e1456c46502e83032adf2ca9480a0fe29403dee24094e04df67

General

Target
pandabanker_2.2.2.vir.exe
Size 330KB
Sample200719-a4sza7ddza
SHA256 a6214596a7509e1456c46502e83032adf2ca9480a0fe29403dee24094e04df67
MD5 89a27b8f3355933e99bb47083aba9744
SHA1 44be1e76b73faa435d43f387940f15c63cc636a1
SHA512 f28a7e60047298f0281c130f1c90b766495767300f221ad67e27cb7f0d1f694c0d36e9ea074e672564e91c8707baeb51e53f980c456accc14f9c455fcd27f9f1
MD5 SHA1 SHA512

Score

9^/10

Executes dropped EXE 1 IoCs

pid	Process
1848	Desktop.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Loads dropped DLL 1 IoCs

pid	Process
1768	pandabanker_2.2.2.vir.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1848	1768	pandabanker_2.2.2.vir.exe	24
PID 1768 wrote to memory of 1848	1768	pandabanker_2.2.2.vir.exe	24
PID 1768 wrote to memory of 1848	1768	pandabanker_2.2.2.vir.exe	24
PID 1768 wrote to memory of 1848	1768	pandabanker_2.2.2.vir.exe	24
PID 1848 wrote to memory of 1948	1848	Desktop.exe	25
PID 1848 wrote to memory of 1948	1848	Desktop.exe	25
PID 1848 wrote to memory of 1948	1848	Desktop.exe	25
PID 1848 wrote to memory of 1948	1848	Desktop.exe	25
PID 1848 wrote to memory of 1948	1848	Desktop.exe	25
PID 1848 wrote to memory of 1948	1848	Desktop.exe	25
PID 1848 wrote to memory of 1948	1848	Desktop.exe	25
PID 1848 wrote to memory of 1948	1848	Desktop.exe	25
PID 1848 wrote to memory of 2012	1848	Desktop.exe	28
PID 1848 wrote to memory of 2012	1848	Desktop.exe	28
PID 1848 wrote to memory of 2012	1848	Desktop.exe	28
PID 1848 wrote to memory of 2012	1848	Desktop.exe	28
PID 1848 wrote to memory of 2012	1848	Desktop.exe	28
PID 1848 wrote to memory of 2012	1848	Desktop.exe	28
PID 1848 wrote to memory of 2012	1848	Desktop.exe	28
PID 1848 wrote to memory of 2012	1848	Desktop.exe	28
PID 1768 wrote to memory of 1144	1768	pandabanker_2.2.2.vir.exe	29
PID 1768 wrote to memory of 1144	1768	pandabanker_2.2.2.vir.exe	29
PID 1768 wrote to memory of 1144	1768	pandabanker_2.2.2.vir.exe	29
PID 1768 wrote to memory of 1144	1768	pandabanker_2.2.2.vir.exe	29

Deletes itself 1 IoCs

pid	Process
1144	cmd.exe

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pandabanker_2.2.2.vir.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\WINE	pandabanker_2.2.2.vir.exe
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\WINE	pandabanker_2.2.2.vir.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.2.vir.exe
"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.2.vir.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Checks BIOS information in registry
- Identifies Wine through registry keys
PID:1768
- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d5vrebxd.default-release\datareporting\archived\2020-06\Desktop.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d5vrebxd.default-release\datareporting\archived\2020-06\Desktop.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:2012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd17dd8abc.bat"
  2⤵
  - Deletes itself
  PID:1144