a6214596a7509e1456c46502e83032adf2ca9480a0fe29403dee24094e04df67

General

Target
pandabanker_2.2.2.vir.exe
Size 330KB
Sample200719-a4sza7ddza
SHA256 a6214596a7509e1456c46502e83032adf2ca9480a0fe29403dee24094e04df67
MD5 89a27b8f3355933e99bb47083aba9744
SHA1 44be1e76b73faa435d43f387940f15c63cc636a1
SHA512 f28a7e60047298f0281c130f1c90b766495767300f221ad67e27cb7f0d1f694c0d36e9ea074e672564e91c8707baeb51e53f980c456accc14f9c455fcd27f9f1
MD5 SHA1 SHA512

Score

9^/10

evasion spyware

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Suspicious behavior: EnumeratesProcesses 20 IoCs

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 1280	3724	pandabanker_2.2.2.vir.exe	68
PID 3724 wrote to memory of 1280	3724	pandabanker_2.2.2.vir.exe	68
PID 3724 wrote to memory of 1280	3724	pandabanker_2.2.2.vir.exe	68
PID 1280 wrote to memory of 1844	1280	PublishExit.exe	70
PID 1280 wrote to memory of 1844	1280	PublishExit.exe	70
PID 1280 wrote to memory of 1844	1280	PublishExit.exe	70
PID 1280 wrote to memory of 1844	1280	PublishExit.exe	70
PID 1280 wrote to memory of 1844	1280	PublishExit.exe	70
PID 1280 wrote to memory of 1844	1280	PublishExit.exe	70
PID 1280 wrote to memory of 1844	1280	PublishExit.exe	70
PID 1280 wrote to memory of 2616	1280	PublishExit.exe	74
PID 1280 wrote to memory of 2616	1280	PublishExit.exe	74
PID 1280 wrote to memory of 2616	1280	PublishExit.exe	74
PID 1280 wrote to memory of 2616	1280	PublishExit.exe	74
PID 1280 wrote to memory of 2616	1280	PublishExit.exe	74
PID 1280 wrote to memory of 2616	1280	PublishExit.exe	74
PID 1280 wrote to memory of 2616	1280	PublishExit.exe	74
PID 3724 wrote to memory of 2784	3724	pandabanker_2.2.2.vir.exe	75
PID 3724 wrote to memory of 2784	3724	pandabanker_2.2.2.vir.exe	75
PID 3724 wrote to memory of 2784	3724	pandabanker_2.2.2.vir.exe	75

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pandabanker_2.2.2.vir.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\WINE	pandabanker_2.2.2.vir.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\WINE	pandabanker_2.2.2.vir.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 3 IoCs

Executes dropped EXE 1 IoCs

pid	Process
1280	PublishExit.exe

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.2.vir.exe
"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.2.vir.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of AdjustPrivilegeToken
PID:3724
- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ah406040.default-release\datareporting\archived\2020-04\PublishExit.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ah406040.default-release\datareporting\archived\2020-04\PublishExit.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:1280
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:2616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd61259483.bat"
  2⤵
  PID:2784