pandazeus | 46e002127e40c0e263b75efe1446d6666f5861c043719768e6d841c8b70482ee

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.Win32.Panda.aof.exe
Size 348KB
Sample261012-l28spsbe34
SHA256 46e002127e40c0e263b75efe1446d6666f5861c043719768e6d841c8b70482ee
MD5 0edc640c21850d4b46d1f0ff9f80970b
SHA1 c9153d691e9a99b0fb4b1d9a01bc7f23cfdafa5d
SHA512 148be98b31270f3878748e2452a8965c1366c0a2fa44a7f0d5a4659de372ea977b36e6c870d0b121f9d1f4581d1afe03ae8998101b1a814ed0e1862e61fd8968
SSDEEP 3072:Dv8XRUH0zUePsZoBN0XIxVY4t2TcoiAIhDG+g3Mk/XcHxeVpxna8RtKggsNGGGxg:DEWUzxQQTVYHojA1+/NxeVLaMpX
TLSH
T131746B11B611C071F7AA0B308861E9D41AA57C395AB0E56FF6693E7EEB322D3453334E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker defense_evasion discovery pandazeus trojan

Malware Config

Signatures

Family: PandaZeuS
PandaZeuS is a banking trojan that utilizes the ATS to automate actions within online banking portals.
trojan banker pandazeus

Detects PandaZeuS 2 IoCs

resource	yara_rule
behavioral2/memory/2476-4-0x0000000024D40000-0x0000000024DC3000-memory.dmp	family_pandazeus
behavioral2/memory/2476-6-0x0000000024D40000-0x0000000024DC3000-memory.dmp	family_pandazeus

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6080	2476	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.Win32.Panda.aof.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2476	jaffacakes118_Trojan-Spy.Win32.Panda.aof.exe
Token: SeBackupPrivilege	2476	jaffacakes118_Trojan-Spy.Win32.Panda.aof.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4608	2476	jaffacakes118_Trojan-Spy.Win32.Panda.aof.exe	90
PID 2476 wrote to memory of 4572	2476	jaffacakes118_Trojan-Spy.Win32.Panda.aof.exe	91

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	jaffacakes118_Trojan-Spy.Win32.Panda.aof.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Panda.aof.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Panda.aof.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2476
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2476" "1036" "828" "1044" "0" "0" "1056" "1060" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4608
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2476" "1036" "1000" "1052" "0" "0" "1044" "1048" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 184
  2⤵
  - Program crash
  PID:6080

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2476 -ip 2476
1⤵
PID:5316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2476-4-0x0000000024D40000-0x0000000024DC3000-memory.dmp

Download

memory/2476-6-0x0000000024D40000-0x0000000024DC3000-memory.dmp