10b85536fedabb3c8ca3bed5822f368ed64a09bb06b4f595ac4dc18aeb565426

General

Target
pandabanker_2.2.11.vir.exe
Size 378KB
Sample200719-n6rd6ddems
SHA256 10b85536fedabb3c8ca3bed5822f368ed64a09bb06b4f595ac4dc18aeb565426
MD5 41d9df6b1a7e6fe50f8b3b94186ad9be
SHA1 da1dd6c5cfabd88c587235d2908b63cd53974577
SHA512 dccb522e7d609c508b147fb2cf353c123766e3a04d9dfbf97f9d7f368bc58d5aa69ad38d7d0a86719c0a9210ad904f84f81920b5297589ecbdec74c8c359c3c1
MD5 SHA1 SHA512

Score

9^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1048	pandabanker_2.2.11.vir.exe

Loads dropped DLL 1 IoCs

pid	Process
1048	pandabanker_2.2.11.vir.exe

Executes dropped EXE 1 IoCs

pid	Process
1028	webappsstore.exe

Deletes itself 1 IoCs

pid	Process
1496	cmd.exe

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Suspicious behavior: EnumeratesProcesses 10 IoCs

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pandabanker_2.2.11.vir.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\WINE	pandabanker_2.2.11.vir.exe
Key opened	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\WINE	pandabanker_2.2.11.vir.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1028	1048	pandabanker_2.2.11.vir.exe	24
PID 1048 wrote to memory of 1028	1048	pandabanker_2.2.11.vir.exe	24
PID 1048 wrote to memory of 1028	1048	pandabanker_2.2.11.vir.exe	24
PID 1048 wrote to memory of 1028	1048	pandabanker_2.2.11.vir.exe	24
PID 1028 wrote to memory of 1520	1028	webappsstore.exe	25
PID 1028 wrote to memory of 1520	1028	webappsstore.exe	25
PID 1028 wrote to memory of 1520	1028	webappsstore.exe	25
PID 1028 wrote to memory of 1520	1028	webappsstore.exe	25
PID 1028 wrote to memory of 1520	1028	webappsstore.exe	25
PID 1028 wrote to memory of 1520	1028	webappsstore.exe	25
PID 1028 wrote to memory of 1520	1028	webappsstore.exe	25
PID 1028 wrote to memory of 1520	1028	webappsstore.exe	25
PID 1028 wrote to memory of 1092	1028	webappsstore.exe	26
PID 1028 wrote to memory of 1092	1028	webappsstore.exe	26
PID 1028 wrote to memory of 1092	1028	webappsstore.exe	26
PID 1028 wrote to memory of 1092	1028	webappsstore.exe	26
PID 1028 wrote to memory of 1092	1028	webappsstore.exe	26
PID 1028 wrote to memory of 1092	1028	webappsstore.exe	26
PID 1028 wrote to memory of 1092	1028	webappsstore.exe	26
PID 1028 wrote to memory of 1092	1028	webappsstore.exe	26
PID 1048 wrote to memory of 1496	1048	pandabanker_2.2.11.vir.exe	28
PID 1048 wrote to memory of 1496	1048	pandabanker_2.2.11.vir.exe	28
PID 1048 wrote to memory of 1496	1048	pandabanker_2.2.11.vir.exe	28
PID 1048 wrote to memory of 1496	1048	pandabanker_2.2.11.vir.exe	28

C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.11.vir.exe
"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.11.vir.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\webappsstore.exe
  "C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\webappsstore.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:1092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd642afd69.bat"
  2⤵
  - Deletes itself
  PID:1496