Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
21-06-2024 18:29
Static task
static1
Behavioral task
behavioral1
Sample
files/Setup.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
files/Setup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
files/Setup.exe
Resource
win11-20240611-en
General
-
Target
files/Setup.exe
-
Size
8.5MB
-
MD5
98169506fec94c2b12ba9930ad704515
-
SHA1
bce662a9fb94551f648ba2d7e29659957fd6a428
-
SHA256
9b8a5b0a45adf843e24214b46c285e44e73bc6eaf9e2a3b2c14a6d93ae541363
-
SHA512
7f4f7ac2326a1a8b7afc72822dae328753578eb0a4ffcec5adb4e4fb0c49703070f71e7411df221ee9f44d6b43a0a94921fe530877c5d5e71640b807e96def30
-
SSDEEP
196608:vdoUox8PFOegKz+qE1cnuyHgv3eZaOxqeXY4K:vC0O9m7EWEvbOxqetK
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Setup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Setup.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Setup.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 3036 set thread context of 2256 3036 Setup.exe more.com -
Executes dropped EXE 1 IoCs
Processes:
Setup.exepid process 2776 Setup.exe -
Loads dropped DLL 2 IoCs
Processes:
more.comhttpd.au3pid process 2256 more.com 2864 httpd.au3 -
Modifies registry class 4 IoCs
Processes:
Setup.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3} Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32 Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32\ = "%SystemRoot%\\System32\\NaturalLanguage6.dll" Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32\ThreadingModel = "Both" Setup.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Setup.exemore.compid process 3036 Setup.exe 3036 Setup.exe 2256 more.com 2256 more.com -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Setup.exemore.compid process 3036 Setup.exe 2256 more.com -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Setup.exemore.comdescription pid process target process PID 3036 wrote to memory of 2776 3036 Setup.exe Setup.exe PID 3036 wrote to memory of 2776 3036 Setup.exe Setup.exe PID 3036 wrote to memory of 2776 3036 Setup.exe Setup.exe PID 3036 wrote to memory of 2776 3036 Setup.exe Setup.exe PID 3036 wrote to memory of 2776 3036 Setup.exe Setup.exe PID 3036 wrote to memory of 2776 3036 Setup.exe Setup.exe PID 3036 wrote to memory of 2776 3036 Setup.exe Setup.exe PID 3036 wrote to memory of 2256 3036 Setup.exe more.com PID 3036 wrote to memory of 2256 3036 Setup.exe more.com PID 3036 wrote to memory of 2256 3036 Setup.exe more.com PID 3036 wrote to memory of 2256 3036 Setup.exe more.com PID 3036 wrote to memory of 2256 3036 Setup.exe more.com PID 2256 wrote to memory of 2864 2256 more.com httpd.au3 PID 2256 wrote to memory of 2864 2256 more.com httpd.au3 PID 2256 wrote to memory of 2864 2256 more.com httpd.au3 PID 2256 wrote to memory of 2864 2256 more.com httpd.au3 PID 2256 wrote to memory of 2864 2256 more.com httpd.au3
Processes
-
C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\loadctrltb\EPHJQWTRVRXFYC\Setup.exeC:\Users\Admin\AppData\Roaming\loadctrltb\EPHJQWTRVRXFYC\Setup.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\httpd.au3C:\Users\Admin\AppData\Local\Temp\httpd.au33⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\943d287eFilesize
2.0MB
MD5113eae30f4d4faf4eaa60880e60f2aee
SHA10409c22a2c84dc78434dd5371093d358b2c993b9
SHA256183068cab1d3c3a35e55e65ab72a6467064a81a0146e9d21d96563990870119c
SHA512f13ffe02e98f1286cc554842cf4ce85e3bd190adebfbad8a3318ff4c46c4b64ed463d26e5e06bfee1b453f69f6f97a3e0e1a02cfe925321f7caef62a56e57256
-
C:\Users\Admin\AppData\Roaming\loadctrltb\EPHJQWTRVRXFYC\Setup.exeFilesize
111KB
MD59f262921a7fbd432c3a694a372caf1b9
SHA1dfd75a8835a5553d457f4f702c7fe5785227854f
SHA25656cff82b9e3ee0ed5e74a3e55115e96fd198598be26492cca7b15d9b9023a238
SHA512cabeaef6132444dc06e7a53332eb58446f7046069044c44b7a27693866a1d66aad7b3ebb5fe7bb79b780548a75b206528f176f5505c574b1c7ad3bcc6fc628b8
-
\Users\Admin\AppData\Local\Temp\httpd.au3Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
memory/2256-50-0x0000000074240000-0x00000000743B4000-memory.dmpFilesize
1.5MB
-
memory/2256-48-0x0000000076DD0000-0x0000000076F79000-memory.dmpFilesize
1.7MB
-
memory/2864-60-0x0000000000080000-0x00000000000DB000-memory.dmpFilesize
364KB
-
memory/2864-57-0x0000000000080000-0x00000000000DB000-memory.dmpFilesize
364KB
-
memory/2864-56-0x0000000076DD0000-0x0000000076F79000-memory.dmpFilesize
1.7MB
-
memory/3036-14-0x0000000000400000-0x0000000001CF7000-memory.dmpFilesize
25.0MB
-
memory/3036-18-0x0000000000400000-0x0000000001CF7000-memory.dmpFilesize
25.0MB
-
memory/3036-37-0x000007FEF5980000-0x000007FEF5AD8000-memory.dmpFilesize
1.3MB
-
memory/3036-39-0x000007FEF5998000-0x000007FEF5999000-memory.dmpFilesize
4KB
-
memory/3036-40-0x000007FEF5980000-0x000007FEF5AD8000-memory.dmpFilesize
1.3MB
-
memory/3036-20-0x0000000004880000-0x0000000004C7A000-memory.dmpFilesize
4.0MB
-
memory/3036-44-0x000007FEF5980000-0x000007FEF5AD8000-memory.dmpFilesize
1.3MB
-
memory/3036-22-0x000007FEF5980000-0x000007FEF5AD8000-memory.dmpFilesize
1.3MB
-
memory/3036-19-0x0000000000400000-0x0000000001CF7000-memory.dmpFilesize
25.0MB
-
memory/3036-0-0x0000000003CD0000-0x0000000003EB8000-memory.dmpFilesize
1.9MB
-
memory/3036-15-0x0000000000400000-0x0000000001CF7000-memory.dmpFilesize
25.0MB
-
memory/3036-16-0x0000000000400000-0x0000000001CF7000-memory.dmpFilesize
25.0MB
-
memory/3036-13-0x0000000000400000-0x0000000001CF7000-memory.dmpFilesize
25.0MB
-
memory/3036-10-0x0000000000400000-0x0000000001CF7000-memory.dmpFilesize
25.0MB