Analysis
-
max time kernel
151s -
max time network
131s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
19-07-2020 19:50
Static task
static1
Behavioral task
behavioral1
Sample
pandabanker_2.6.4.vir.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
pandabanker_2.6.4.vir.exe
Resource
win10
General
-
Target
pandabanker_2.6.4.vir.exe
-
Size
444KB
-
MD5
2f7d8654ed24dc7e0b29431ec41abbf9
-
SHA1
5d87ef3c00ccce0885158a1029eb751b1f615b2f
-
SHA256
68264c44774c650ce96e87807781ed0dcf25a1d50cc90e08731fde466b25c791
-
SHA512
8d7d1321cea04db8fb8ec08f85ed9d294a5f597284099e429be44c353fadacca9780779f2f7e570b4a06877166a2b2aabb878637af7122d2d02704ede455812f
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
pandabanker_2.6.4.vir.exedd_wcf_CA_smci_20200430_122900_990.exedescription ioc process File opened for modification C:\Windows\win.ini pandabanker_2.6.4.vir.exe File opened for modification C:\Windows\win.ini dd_wcf_CA_smci_20200430_122900_990.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\Currentversion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\dd_wcf_CA_smci_20200430_122900_990.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Storage\\ext\\gfdkimpbcpahaombhbimeihdjnejgicl\\def\\Code Cache\\js\\index-dir\\dd_wcf_CA_smci_20200430_122900_990.exe\"" svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
pandabanker_2.6.4.vir.exepid process 1292 pandabanker_2.6.4.vir.exe -
Executes dropped EXE 1 IoCs
Processes:
dd_wcf_CA_smci_20200430_122900_990.exepid process 1368 dd_wcf_CA_smci_20200430_122900_990.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1776 cmd.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
pandabanker_2.6.4.vir.exedd_wcf_CA_smci_20200430_122900_990.exedescription pid process target process PID 1292 wrote to memory of 1368 1292 pandabanker_2.6.4.vir.exe dd_wcf_CA_smci_20200430_122900_990.exe PID 1292 wrote to memory of 1368 1292 pandabanker_2.6.4.vir.exe dd_wcf_CA_smci_20200430_122900_990.exe PID 1292 wrote to memory of 1368 1292 pandabanker_2.6.4.vir.exe dd_wcf_CA_smci_20200430_122900_990.exe PID 1292 wrote to memory of 1368 1292 pandabanker_2.6.4.vir.exe dd_wcf_CA_smci_20200430_122900_990.exe PID 1292 wrote to memory of 1776 1292 pandabanker_2.6.4.vir.exe cmd.exe PID 1292 wrote to memory of 1776 1292 pandabanker_2.6.4.vir.exe cmd.exe PID 1292 wrote to memory of 1776 1292 pandabanker_2.6.4.vir.exe cmd.exe PID 1292 wrote to memory of 1776 1292 pandabanker_2.6.4.vir.exe cmd.exe PID 1368 wrote to memory of 320 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 320 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 320 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 320 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 320 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 320 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 320 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 320 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 1128 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 1128 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 1128 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 1128 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 1128 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 1128 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 1128 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe PID 1368 wrote to memory of 1128 1368 dd_wcf_CA_smci_20200430_122900_990.exe svchost.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
pandabanker_2.6.4.vir.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\WINE pandabanker_2.6.4.vir.exe Key opened \REGISTRY\MACHINE\Software\Wow6432Node\WINE pandabanker_2.6.4.vir.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
pandabanker_2.6.4.vir.exedd_wcf_CA_smci_20200430_122900_990.exepid process 1292 pandabanker_2.6.4.vir.exe 1368 dd_wcf_CA_smci_20200430_122900_990.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
pandabanker_2.6.4.vir.exesvchost.exesvchost.exepid process 1292 pandabanker_2.6.4.vir.exe 1292 pandabanker_2.6.4.vir.exe 1292 pandabanker_2.6.4.vir.exe 1292 pandabanker_2.6.4.vir.exe 1292 pandabanker_2.6.4.vir.exe 1292 pandabanker_2.6.4.vir.exe 1292 pandabanker_2.6.4.vir.exe 1292 pandabanker_2.6.4.vir.exe 1292 pandabanker_2.6.4.vir.exe 1292 pandabanker_2.6.4.vir.exe 320 svchost.exe 320 svchost.exe 1128 svchost.exe 1128 svchost.exe 320 svchost.exe 320 svchost.exe 1128 svchost.exe 1128 svchost.exe 320 svchost.exe 320 svchost.exe 1128 svchost.exe 1128 svchost.exe 320 svchost.exe 320 svchost.exe 1128 svchost.exe 1128 svchost.exe 320 svchost.exe 320 svchost.exe 1128 svchost.exe 1128 svchost.exe 320 svchost.exe 320 svchost.exe 1128 svchost.exe 1128 svchost.exe 320 svchost.exe 320 svchost.exe 1128 svchost.exe 1128 svchost.exe 320 svchost.exe 320 svchost.exe 1128 svchost.exe 1128 svchost.exe 320 svchost.exe 320 svchost.exe 1128 svchost.exe 1128 svchost.exe 320 svchost.exe 320 svchost.exe 1128 svchost.exe 1128 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
pandabanker_2.6.4.vir.exedescription pid process Token: SeSecurityPrivilege 1292 pandabanker_2.6.4.vir.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pandabanker_2.6.4.vir.exe"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.6.4.vir.exe"1⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Identifies Wine through registry keys
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\dd_wcf_CA_smci_20200430_122900_990.exe"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\dd_wcf_CA_smci_20200430_122900_990.exe"2⤵
- Drops file in Windows directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd67827a91.bat"2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\dd_wcf_CA_smci_20200430_122900_990.exe
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\dd_wcf_CA_smci_20200430_122900_990.exe
-
C:\Users\Admin\AppData\Local\Temp\upd67827a91.bat
-
C:\Windows\win.ini
-
\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\dd_wcf_CA_smci_20200430_122900_990.exe
-
memory/320-7-0x0000000000000000-mapping.dmp
-
memory/1128-8-0x0000000000000000-mapping.dmp
-
memory/1368-1-0x0000000000000000-mapping.dmp
-
memory/1776-5-0x0000000000000000-mapping.dmp