5782c7ade207fd4415c35bd1e98bad7c3fcaef206fa60f142b8d1062e7103670

General

Target

pandabanker_2.6.5.vir.exe
Size

189KB
MD5

5c47e3ed6dea436b0f99141bb5799fa9
SHA1

4e6169ef0a6dfc2c8253540362f93fedd06774c6
SHA256

5782c7ade207fd4415c35bd1e98bad7c3fcaef206fa60f142b8d1062e7103670
SHA512

797333f31f93505f74bc80316b68dfc1cc179128edfb0e476e320dd53dbcc5d9fa5a88210f7bcf76a6d10aa2429b542de6c01c2e3b6f5552798a6b134849070c

Score

8^/10

evasion spyware persistence

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

pandabanker_2.6.5.vir.exesvchost.exe

pid	process
1092	pandabanker_2.6.5.vir.exe
1092	pandabanker_2.6.5.vir.exe
1092	pandabanker_2.6.5.vir.exe
1092	pandabanker_2.6.5.vir.exe
1092	pandabanker_2.6.5.vir.exe
1092	pandabanker_2.6.5.vir.exe
1092	pandabanker_2.6.5.vir.exe
1092	pandabanker_2.6.5.vir.exe
1092	pandabanker_2.6.5.vir.exe
1092	pandabanker_2.6.5.vir.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe
1772	svchost.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

pandabanker_2.6.5.vir.exesetup.exe

description	pid	process	target process
PID 1092 wrote to memory of 1248	1092	pandabanker_2.6.5.vir.exe	setup.exe
PID 1092 wrote to memory of 1248	1092	pandabanker_2.6.5.vir.exe	setup.exe
PID 1092 wrote to memory of 1248	1092	pandabanker_2.6.5.vir.exe	setup.exe
PID 1092 wrote to memory of 1248	1092	pandabanker_2.6.5.vir.exe	setup.exe
PID 1092 wrote to memory of 1248	1092	pandabanker_2.6.5.vir.exe	setup.exe
PID 1092 wrote to memory of 1248	1092	pandabanker_2.6.5.vir.exe	setup.exe
PID 1092 wrote to memory of 1248	1092	pandabanker_2.6.5.vir.exe	setup.exe
PID 1092 wrote to memory of 1504	1092	pandabanker_2.6.5.vir.exe	cmd.exe
PID 1092 wrote to memory of 1504	1092	pandabanker_2.6.5.vir.exe	cmd.exe
PID 1092 wrote to memory of 1504	1092	pandabanker_2.6.5.vir.exe	cmd.exe
PID 1092 wrote to memory of 1504	1092	pandabanker_2.6.5.vir.exe	cmd.exe
PID 1248 wrote to memory of 1772	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1772	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1772	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1772	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1772	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1772	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1772	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1772	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1772	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1772	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1772	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1204	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1204	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1204	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1204	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1204	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1204	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1204	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1204	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1204	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1204	1248	setup.exe	svchost.exe
PID 1248 wrote to memory of 1204	1248	setup.exe	svchost.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

pandabanker_2.6.5.vir.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\WINE	pandabanker_2.6.5.vir.exe
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\WINE	pandabanker_2.6.5.vir.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\Currentversion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\setup.exe = "C:\\Users\\Admin\\AppData\\Local\\Adobe\\Acrobat\\9.0\\Cache\\setup.exe"	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

pandabanker_2.6.5.vir.exe

description pid process

Token: SeSecurityPrivilege 1092 pandabanker_2.6.5.vir.exe
Loads dropped DLL 4 IoCs

Processes:

pandabanker_2.6.5.vir.exesetup.exe

pid process

1092 pandabanker_2.6.5.vir.exe
1248 setup.exe
1248 setup.exe
1248 setup.exe
Executes dropped EXE 1 IoCs

Processes:

setup.exe

pid process

1248 setup.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1504 cmd.exe

description	pid	process
Token: SeSecurityPrivilege	1092	pandabanker_2.6.5.vir.exe

pid	process
1248	setup.exe

pid	process
1504	cmd.exe

C:\Users\Admin\AppData\Local\Temp\pandabanker_2.6.5.vir.exe
"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.6.5.vir.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Identifies Wine through registry keys
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
PID:1092

C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\setup.exe
"C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\setup.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Executes dropped EXE
PID:1248

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
PID:1772

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
3⤵
PID:1204

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd7b625c1c.bat"
2⤵
- Deletes itself
PID:1504

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\setup.exe

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\setup.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\upd7b625c1c.bat

Download Submit
\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\setup.exe

Download Submit
\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\setup.exe

Download Submit
\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\setup.exe

Download Submit
\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\setup.exe

Download Submit
memory/1204-10-0x0000000000000000-mapping.dmp

Download
memory/1248-1-0x0000000000000000-mapping.dmp

Download
memory/1504-7-0x0000000000000000-mapping.dmp

Download
memory/1772-9-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads