62989ab56f11701b109cddf0eb20e995c833078bb40942a8c931589497c25948

General

Target

pandabanker_2.1.1.vir.exe
Size

308KB
MD5

ed09632e3d549edb8f31eaac5562df7c
SHA1

d78f465ffb433d4f2c9382e22e028709567c7eba
SHA256

62989ab56f11701b109cddf0eb20e995c833078bb40942a8c931589497c25948
SHA512

5a4fd769e5eafd76704eff6138eb25637353bdd4e23c769f327f76e2e3dad6cbae06ce7090b88b1d6802e7dfd94639b4316334435fdc2b4efc8f13226e176e2b

Score

8^/10

spyware

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pandabanker_2.1.1.vir.exe

description pid process

Token: SeSecurityPrivilege 792 pandabanker_2.1.1.vir.exe
Token: SeSecurityPrivilege 792 pandabanker_2.1.1.vir.exe

description	pid	process
Token: SeSecurityPrivilege	792	pandabanker_2.1.1.vir.exe
Token: SeSecurityPrivilege	792	pandabanker_2.1.1.vir.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

pandabanker_2.1.1.vir.exeextension-preferences.exe

description	pid	process	target process
PID 792 wrote to memory of 3636	792	pandabanker_2.1.1.vir.exe	extension-preferences.exe
PID 792 wrote to memory of 3636	792	pandabanker_2.1.1.vir.exe	extension-preferences.exe
PID 792 wrote to memory of 3636	792	pandabanker_2.1.1.vir.exe	extension-preferences.exe
PID 3636 wrote to memory of 3880	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3880	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3880	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3880	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3880	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3880	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3880	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3880	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3004	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3004	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3004	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3004	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3004	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3004	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3004	3636	extension-preferences.exe	svchost.exe
PID 3636 wrote to memory of 3004	3636	extension-preferences.exe	svchost.exe
PID 792 wrote to memory of 3876	792	pandabanker_2.1.1.vir.exe	cmd.exe
PID 792 wrote to memory of 3876	792	pandabanker_2.1.1.vir.exe	cmd.exe
PID 792 wrote to memory of 3876	792	pandabanker_2.1.1.vir.exe	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

extension-preferences.exe

pid process

3636 extension-preferences.exe

pid	process
3636	extension-preferences.exe

C:\Users\Admin\AppData\Local\Temp\pandabanker_2.1.1.vir.exe
"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.1.1.vir.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lj62mcv.default-release\storage\extension-preferences.exe
"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lj62mcv.default-release\storage\extension-preferences.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:3636

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
3⤵
PID:3880

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
3⤵
PID:3004

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd38092443.bat"
2⤵
PID:3876

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\upd38092443.bat

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lj62mcv.default-release\storage\extension-preferences.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lj62mcv.default-release\storage\extension-preferences.exe

Download Submit
memory/3004-4-0x0000000000000000-mapping.dmp

Download
memory/3636-0-0x0000000000000000-mapping.dmp

Download
memory/3876-5-0x0000000000000000-mapping.dmp

Download
memory/3880-3-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing