10b85536fedabb3c8ca3bed5822f368ed64a09bb06b4f595ac4dc18aeb565426

General

Target
pandabanker_2.2.11.vir.exe
Size 378KB
Sample200719-n6rd6ddems
SHA256 10b85536fedabb3c8ca3bed5822f368ed64a09bb06b4f595ac4dc18aeb565426
MD5 41d9df6b1a7e6fe50f8b3b94186ad9be
SHA1 da1dd6c5cfabd88c587235d2908b63cd53974577
SHA512 dccb522e7d609c508b147fb2cf353c123766e3a04d9dfbf97f9d7f368bc58d5aa69ad38d7d0a86719c0a9210ad904f84f81920b5297589ecbdec74c8c359c3c1
MD5 SHA1 SHA512

Score

9^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1684	pandabanker_2.2.11.vir.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2572	1684	pandabanker_2.2.11.vir.exe	71
PID 1684 wrote to memory of 2572	1684	pandabanker_2.2.11.vir.exe	71
PID 1684 wrote to memory of 2572	1684	pandabanker_2.2.11.vir.exe	71
PID 2572 wrote to memory of 4072	2572	installs.exe	72
PID 2572 wrote to memory of 4072	2572	installs.exe	72
PID 2572 wrote to memory of 4072	2572	installs.exe	72
PID 2572 wrote to memory of 4072	2572	installs.exe	72
PID 2572 wrote to memory of 4072	2572	installs.exe	72
PID 2572 wrote to memory of 4072	2572	installs.exe	72
PID 2572 wrote to memory of 4072	2572	installs.exe	72
PID 2572 wrote to memory of 3968	2572	installs.exe	73
PID 2572 wrote to memory of 3968	2572	installs.exe	73
PID 2572 wrote to memory of 3968	2572	installs.exe	73
PID 2572 wrote to memory of 3968	2572	installs.exe	73
PID 2572 wrote to memory of 3968	2572	installs.exe	73
PID 2572 wrote to memory of 3968	2572	installs.exe	73
PID 2572 wrote to memory of 3968	2572	installs.exe	73
PID 1684 wrote to memory of 3816	1684	pandabanker_2.2.11.vir.exe	74
PID 1684 wrote to memory of 3816	1684	pandabanker_2.2.11.vir.exe	74
PID 1684 wrote to memory of 3816	1684	pandabanker_2.2.11.vir.exe	74

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Suspicious behavior: EnumeratesProcesses 20 IoCs

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pandabanker_2.2.11.vir.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\WINE	pandabanker_2.2.11.vir.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\WINE	pandabanker_2.2.11.vir.exe

Executes dropped EXE 1 IoCs

pid	Process
2572	installs.exe

C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.11.vir.exe
"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.2.11.vir.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Checks BIOS information in registry
- Identifies Wine through registry keys
PID:1684
- C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\installs.exe
  "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\installs.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:2572
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:4072
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    3⤵
    PID:3968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upda6fdb18c.bat"
  2⤵
  PID:3816