Analysis
- max time kernel
149s - max time network
127s - platform
windows10_x64 - resource
win10 - submitted
19/07/2020, 19:43
Static task
static1
Behavioral task
behavioral1
Sample
pandabanker_2.2.7.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
pandabanker_2.2.7.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target pandabanker_2.2.7.vir.exe
- Size 215KB
- Sample200719-mt7bc4bw6j
- SHA256 f21872a03fcb62dbac5cd7ea2c92db4595f4a55906d7a91ffa6ce5cae2b84e91
- MD5 ae44ce6f422f1fd953420988df1efc49
- SHA1 9477e5b412d65971415f7ecdba3bfbfa5de69b62
- SHA512 058422015da7c5478fc2bcf15a5bb8522b8300dbc626ad6cc86bd0480baf4b244b331d1fe5fe6ffbd2ded69d1d31b886522e3a71dd50603a6e7f9115f0a95c8a
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeSecurityPrivilege 3556 pandabanker_2.2.7.vir.exe Token: SeSecurityPrivilege 3556 pandabanker_2.2.7.vir.exe Token: SeSecurityPrivilege 3556 pandabanker_2.2.7.vir.exe - Looks for VMWare Tools registry key 2 TTPs
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\WINE pandabanker_2.2.7.vir.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\WINE pandabanker_2.2.7.vir.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\Currentversion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\SyncInstall.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\SyncInstall.exe" svchost.exe - Suspicious behavior: EnumeratesProcesses 312 IoCs
pid Process 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3556 pandabanker_2.2.7.vir.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe 3788 svchost.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2920 wrote to memory of 3556 2920 pandabanker_2.2.7.vir.exe 67 PID 2920 wrote to memory of 3556 2920 pandabanker_2.2.7.vir.exe 67 PID 2920 wrote to memory of 3556 2920 pandabanker_2.2.7.vir.exe 67 PID 2920 wrote to memory of 3556 2920 pandabanker_2.2.7.vir.exe 67 PID 2920 wrote to memory of 3556 2920 pandabanker_2.2.7.vir.exe 67 PID 2920 wrote to memory of 3556 2920 pandabanker_2.2.7.vir.exe 67 PID 2920 wrote to memory of 3556 2920 pandabanker_2.2.7.vir.exe 67 PID 2920 wrote to memory of 3556 2920 pandabanker_2.2.7.vir.exe 67 PID 2920 wrote to memory of 3556 2920 pandabanker_2.2.7.vir.exe 67 PID 3556 wrote to memory of 3736 3556 pandabanker_2.2.7.vir.exe 68 PID 3556 wrote to memory of 3736 3556 pandabanker_2.2.7.vir.exe 68 PID 3556 wrote to memory of 3736 3556 pandabanker_2.2.7.vir.exe 68 PID 3736 wrote to memory of 1460 3736 SyncInstall.exe 69 PID 3736 wrote to memory of 1460 3736 SyncInstall.exe 69 PID 3736 wrote to memory of 1460 3736 SyncInstall.exe 69 PID 3736 wrote to memory of 1460 3736 SyncInstall.exe 69 PID 3736 wrote to memory of 1460 3736 SyncInstall.exe 69 PID 3736 wrote to memory of 1460 3736 SyncInstall.exe 69 PID 3736 wrote to memory of 1460 3736 SyncInstall.exe 69 PID 3736 wrote to memory of 1460 3736 SyncInstall.exe 69 PID 3736 wrote to memory of 1460 3736 SyncInstall.exe 69 PID 1460 wrote to memory of 3788 1460 SyncInstall.exe 70 PID 1460 wrote to memory of 3788 1460 SyncInstall.exe 70 PID 1460 wrote to memory of 3788 1460 SyncInstall.exe 70 PID 1460 wrote to memory of 3788 1460 SyncInstall.exe 70 PID 1460 wrote to memory of 3788 1460 SyncInstall.exe 70 PID 1460 wrote to memory of 3788 1460 SyncInstall.exe 70 PID 1460 wrote to memory of 3788 1460 SyncInstall.exe 70 PID 3556 wrote to memory of 3764 3556 pandabanker_2.2.7.vir.exe 71 PID 3556 wrote to memory of 3764 3556 pandabanker_2.2.7.vir.exe 71 PID 3556 wrote to memory of 3764 3556 pandabanker_2.2.7.vir.exe 71 PID 1460 wrote to memory of 3904 1460 SyncInstall.exe 73 PID 1460 wrote to memory of 3904 1460 SyncInstall.exe 73 PID 1460 wrote to memory of 3904 1460 SyncInstall.exe 73 PID 1460 wrote to memory of 3904 1460 SyncInstall.exe 73 PID 1460 wrote to memory of 3904 1460 SyncInstall.exe 73 PID 1460 wrote to memory of 3904 1460 SyncInstall.exe 73 PID 1460 wrote to memory of 3904 1460 SyncInstall.exe 73 - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2920 set thread context of 3556 2920 pandabanker_2.2.7.vir.exe 67 PID 3736 set thread context of 1460 3736 SyncInstall.exe 69 - Executes dropped EXE 2 IoCs
pid Process 3736 SyncInstall.exe 1460 SyncInstall.exe - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion pandabanker_2.2.7.vir.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2920 pandabanker_2.2.7.vir.exe 3736 SyncInstall.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.7.vir.exe"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.7.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.7.vir.exe"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.7.vir.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Checks BIOS information in registry
PID:3556 -
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\SyncInstall.exe"C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\SyncInstall.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3736 -
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\SyncInstall.exe"C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\SyncInstall.exe"4⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1460 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs5⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3788
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs5⤵PID:3904
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd9f2f17ca.bat"3⤵PID:3764
-
-