Analysis
- max time kernel
129s - max time network
126s - platform
windows10_x64 - resource
win10 - submitted
19/07/2020, 19:28
General
- Target pandabanker_2.5.3.vir.exe
- Size 318KB
- Sample200719-b4enqzewq2
- SHA256 89c7c8a795578ef239fef68fe949c29f50f7f40833f6eb87eabf66cae290eab6
Score
8/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Executes dropped EXE 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pandabanker_2.5.3.vir.exe"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.5.3.vir.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Checks SCSI registry key(s)
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\storage.exe"C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\storage.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd8a532f78.bat"2⤵
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s TapiSrv1⤵