Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10_x64 -
resource
win10 -
submitted
19-07-2020 19:50
Static task
static1
Behavioral task
behavioral1
Sample
pandabanker_2.6.4.vir.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
pandabanker_2.6.4.vir.exe
Resource
win10
General
-
Target
pandabanker_2.6.4.vir.exe
-
Size
444KB
-
MD5
2f7d8654ed24dc7e0b29431ec41abbf9
-
SHA1
5d87ef3c00ccce0885158a1029eb751b1f615b2f
-
SHA256
68264c44774c650ce96e87807781ed0dcf25a1d50cc90e08731fde466b25c791
-
SHA512
8d7d1321cea04db8fb8ec08f85ed9d294a5f597284099e429be44c353fadacca9780779f2f7e570b4a06877166a2b2aabb878637af7122d2d02704ede455812f
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
pandabanker_2.6.4.vir.exesvchost.exesvchost.exepid process 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 3980 pandabanker_2.6.4.vir.exe 2144 svchost.exe 2144 svchost.exe 2676 svchost.exe 2676 svchost.exe 2144 svchost.exe 2144 svchost.exe 2676 svchost.exe 2676 svchost.exe 2144 svchost.exe 2144 svchost.exe 2676 svchost.exe 2676 svchost.exe 2144 svchost.exe 2144 svchost.exe 2676 svchost.exe 2676 svchost.exe 2144 svchost.exe 2144 svchost.exe 2676 svchost.exe 2676 svchost.exe 2144 svchost.exe 2144 svchost.exe 2676 svchost.exe 2676 svchost.exe 2144 svchost.exe 2144 svchost.exe 2676 svchost.exe 2676 svchost.exe 2144 svchost.exe 2144 svchost.exe 2676 svchost.exe 2676 svchost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
pandabanker_2.6.4.vir.exeEDBres00002.exedescription pid process target process PID 3980 wrote to memory of 752 3980 pandabanker_2.6.4.vir.exe EDBres00002.exe PID 3980 wrote to memory of 752 3980 pandabanker_2.6.4.vir.exe EDBres00002.exe PID 3980 wrote to memory of 752 3980 pandabanker_2.6.4.vir.exe EDBres00002.exe PID 3980 wrote to memory of 1788 3980 pandabanker_2.6.4.vir.exe cmd.exe PID 3980 wrote to memory of 1788 3980 pandabanker_2.6.4.vir.exe cmd.exe PID 3980 wrote to memory of 1788 3980 pandabanker_2.6.4.vir.exe cmd.exe PID 752 wrote to memory of 2144 752 EDBres00002.exe svchost.exe PID 752 wrote to memory of 2144 752 EDBres00002.exe svchost.exe PID 752 wrote to memory of 2144 752 EDBres00002.exe svchost.exe PID 752 wrote to memory of 2144 752 EDBres00002.exe svchost.exe PID 752 wrote to memory of 2144 752 EDBres00002.exe svchost.exe PID 752 wrote to memory of 2144 752 EDBres00002.exe svchost.exe PID 752 wrote to memory of 2144 752 EDBres00002.exe svchost.exe PID 752 wrote to memory of 2676 752 EDBres00002.exe svchost.exe PID 752 wrote to memory of 2676 752 EDBres00002.exe svchost.exe PID 752 wrote to memory of 2676 752 EDBres00002.exe svchost.exe PID 752 wrote to memory of 2676 752 EDBres00002.exe svchost.exe PID 752 wrote to memory of 2676 752 EDBres00002.exe svchost.exe PID 752 wrote to memory of 2676 752 EDBres00002.exe svchost.exe PID 752 wrote to memory of 2676 752 EDBres00002.exe svchost.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
pandabanker_2.6.4.vir.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\WINE pandabanker_2.6.4.vir.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\WINE pandabanker_2.6.4.vir.exe -
Drops file in Windows directory 2 IoCs
Processes:
pandabanker_2.6.4.vir.exeEDBres00002.exedescription ioc process File opened for modification C:\Windows\win.ini pandabanker_2.6.4.vir.exe File opened for modification C:\Windows\win.ini EDBres00002.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
pandabanker_2.6.4.vir.exeEDBres00002.exepid process 3980 pandabanker_2.6.4.vir.exe 752 EDBres00002.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
pandabanker_2.6.4.vir.exedescription pid process Token: SeSecurityPrivilege 3980 pandabanker_2.6.4.vir.exe -
Executes dropped EXE 1 IoCs
Processes:
EDBres00002.exepid process 752 EDBres00002.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\Currentversion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\EDBres00002.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Storage\\ext\\gfdkimpbcpahaombhbimeihdjnejgicl\\def\\Code Cache\\js\\index-dir\\EDBres00002.exe\"" svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pandabanker_2.6.4.vir.exe"C:\Users\Admin\AppData\Local\Temp\pandabanker_2.6.4.vir.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Identifies Wine through registry keys
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\EDBres00002.exe"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\EDBres00002.exe"2⤵
- Suspicious use of WriteProcessMemory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\updcf05c276.bat"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\EDBres00002.exe
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\EDBres00002.exe
-
C:\Users\Admin\AppData\Local\Temp\updcf05c276.bat
-
C:\Windows\win.ini
-
memory/752-0-0x0000000000000000-mapping.dmp
-
memory/1788-4-0x0000000000000000-mapping.dmp
-
memory/2144-6-0x0000000000000000-mapping.dmp
-
memory/2676-7-0x0000000000000000-mapping.dmp