Analysis
- max time kernel
149s - max time network
118s - platform
windows10_x64 - resource
win10 - submitted
19/07/2020, 19:35
Static task
static1
Behavioral task
behavioral1
Sample
pandabanker_2.2.10.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
pandabanker_2.2.10.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target pandabanker_2.2.10.vir.exe
- Size 222KB
- Sample200719-cv5ancm88x
- SHA256 0d61cc62923f2df6a74fd877cc41c5a4df61355a3ded608bab7b9dde0fb98f41
- MD5 9a9734e363a41dcacff3cba04c8d9512
- SHA1 6a7a319ae1472ef36a73bf3088706ed6acceff76
- SHA512 7490d2204b4a879e60d63ec7e633a0bca10a309898df67c13dac7f6da9e47f4d41adcb9865895ddd50803a735281f1b0c0bd8a7ca8f2a325f2e6d45655664f82
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 3920 wrote to memory of 3008 3920 pandabanker_2.2.10.vir.exe 67 PID 3920 wrote to memory of 3008 3920 pandabanker_2.2.10.vir.exe 67 PID 3920 wrote to memory of 3008 3920 pandabanker_2.2.10.vir.exe 67 PID 3920 wrote to memory of 3008 3920 pandabanker_2.2.10.vir.exe 67 PID 3920 wrote to memory of 3008 3920 pandabanker_2.2.10.vir.exe 67 PID 3920 wrote to memory of 3008 3920 pandabanker_2.2.10.vir.exe 67 PID 3920 wrote to memory of 3008 3920 pandabanker_2.2.10.vir.exe 67 PID 3920 wrote to memory of 3008 3920 pandabanker_2.2.10.vir.exe 67 PID 3920 wrote to memory of 3008 3920 pandabanker_2.2.10.vir.exe 67 PID 3008 wrote to memory of 2888 3008 pandabanker_2.2.10.vir.exe 68 PID 3008 wrote to memory of 2888 3008 pandabanker_2.2.10.vir.exe 68 PID 3008 wrote to memory of 2888 3008 pandabanker_2.2.10.vir.exe 68 PID 2888 wrote to memory of 3852 2888 3647222921wleabcEoxlt-eengsairo.exe 69 PID 2888 wrote to memory of 3852 2888 3647222921wleabcEoxlt-eengsairo.exe 69 PID 2888 wrote to memory of 3852 2888 3647222921wleabcEoxlt-eengsairo.exe 69 PID 2888 wrote to memory of 3852 2888 3647222921wleabcEoxlt-eengsairo.exe 69 PID 2888 wrote to memory of 3852 2888 3647222921wleabcEoxlt-eengsairo.exe 69 PID 2888 wrote to memory of 3852 2888 3647222921wleabcEoxlt-eengsairo.exe 69 PID 2888 wrote to memory of 3852 2888 3647222921wleabcEoxlt-eengsairo.exe 69 PID 2888 wrote to memory of 3852 2888 3647222921wleabcEoxlt-eengsairo.exe 69 PID 2888 wrote to memory of 3852 2888 3647222921wleabcEoxlt-eengsairo.exe 69 PID 3008 wrote to memory of 2568 3008 pandabanker_2.2.10.vir.exe 70 PID 3008 wrote to memory of 2568 3008 pandabanker_2.2.10.vir.exe 70 PID 3008 wrote to memory of 2568 3008 pandabanker_2.2.10.vir.exe 70 PID 3852 wrote to memory of 3360 3852 3647222921wleabcEoxlt-eengsairo.exe 71 PID 3852 wrote to memory of 3360 3852 3647222921wleabcEoxlt-eengsairo.exe 71 PID 3852 wrote to memory of 3360 3852 3647222921wleabcEoxlt-eengsairo.exe 71 PID 3852 wrote to memory of 3360 3852 3647222921wleabcEoxlt-eengsairo.exe 71 PID 3852 wrote to memory of 3360 3852 3647222921wleabcEoxlt-eengsairo.exe 71 PID 3852 wrote to memory of 3360 3852 3647222921wleabcEoxlt-eengsairo.exe 71 PID 3852 wrote to memory of 3360 3852 3647222921wleabcEoxlt-eengsairo.exe 71 PID 3852 wrote to memory of 732 3852 3647222921wleabcEoxlt-eengsairo.exe 73 PID 3852 wrote to memory of 732 3852 3647222921wleabcEoxlt-eengsairo.exe 73 PID 3852 wrote to memory of 732 3852 3647222921wleabcEoxlt-eengsairo.exe 73 PID 3852 wrote to memory of 732 3852 3647222921wleabcEoxlt-eengsairo.exe 73 PID 3852 wrote to memory of 732 3852 3647222921wleabcEoxlt-eengsairo.exe 73 PID 3852 wrote to memory of 732 3852 3647222921wleabcEoxlt-eengsairo.exe 73 PID 3852 wrote to memory of 732 3852 3647222921wleabcEoxlt-eengsairo.exe 73 - Suspicious behavior: EnumeratesProcesses 314 IoCs
pid Process 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3008 pandabanker_2.2.10.vir.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe 3360 svchost.exe - Executes dropped EXE 2 IoCs
pid Process 2888 3647222921wleabcEoxlt-eengsairo.exe 3852 3647222921wleabcEoxlt-eengsairo.exe - Looks for VMWare Tools registry key 2 TTPs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3920 pandabanker_2.2.10.vir.exe 2888 3647222921wleabcEoxlt-eengsairo.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3920 set thread context of 3008 3920 pandabanker_2.2.10.vir.exe 67 PID 2888 set thread context of 3852 2888 3647222921wleabcEoxlt-eengsairo.exe 69 - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 3008 pandabanker_2.2.10.vir.exe - Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\MACHINE\Software\WOW6432Node\WINE pandabanker_2.2.10.vir.exe Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\WINE pandabanker_2.2.10.vir.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\Currentversion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\3647222921wleabcEoxlt-eengsairo.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\3647222921wleabcEoxlt-eengsairo.exe" svchost.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion pandabanker_2.2.10.vir.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.10.vir.exe"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.10.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.10.vir.exe"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.10.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Identifies Wine through registry keys
- Checks BIOS information in registry
PID:3008 -
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\3647222921wleabcEoxlt-eengsairo.exe"C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\3647222921wleabcEoxlt-eengsairo.exe"3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
PID:2888 -
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\3647222921wleabcEoxlt-eengsairo.exe"C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\3647222921wleabcEoxlt-eengsairo.exe"4⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:3852 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs5⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
PID:3360
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs5⤵PID:732
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd99246bb5.bat"3⤵PID:2568
-
-