Analysis

  • max time kernel
    143s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-06-2024 23:12

General

  • Target

    0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08.exe

  • Size

    4.4MB

  • MD5

    4970d0955c11c640bd3616f136211e90

  • SHA1

    05e4966f7a5da9dbc4758e72639f1497ae9a6da0

  • SHA256

    0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08

  • SHA512

    c02adab04a6113d57464de1698a832a299db8f20b8db0b9f546a7bcef443adb73a0875a01fa7656771ac71ad80ca56fd1d020eff71347e4a924aa9c8a904d476

  • SSDEEP

    98304:EYSJEVsF0vujuwWxry+/r4+MYzLC2AXn7pcw39DZnH:EYZVsF0vaBcO+/hZALpc4DZnH

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08.exe
    "C:\Users\Admin\AppData\Local\Temp\0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08.exe"
    1⤵
    • Checks BIOS information in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4488

Network

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4488-1-0x0000000000400000-0x0000000000C13000-memory.dmp
    Filesize

    8.1MB

  • memory/4488-2-0x0000000002F70000-0x000000000316C000-memory.dmp
    Filesize

    2.0MB

  • memory/4488-9-0x0000000002F70000-0x000000000316C000-memory.dmp
    Filesize

    2.0MB

  • memory/4488-12-0x0000000000400000-0x0000000000C13000-memory.dmp
    Filesize

    8.1MB

  • memory/4488-13-0x0000000000400000-0x0000000000C13000-memory.dmp
    Filesize

    8.1MB

  • memory/4488-15-0x0000000000400000-0x0000000000C13000-memory.dmp
    Filesize

    8.1MB

  • memory/4488-16-0x0000000000400000-0x0000000000C13000-memory.dmp
    Filesize

    8.1MB

  • memory/4488-17-0x0000000000400000-0x0000000000C13000-memory.dmp
    Filesize

    8.1MB

  • memory/4488-19-0x0000000002F70000-0x000000000316C000-memory.dmp
    Filesize

    2.0MB

  • memory/4488-18-0x0000000000400000-0x0000000000C13000-memory.dmp
    Filesize

    8.1MB

  • memory/4488-20-0x0000000002F70000-0x000000000316C000-memory.dmp
    Filesize

    2.0MB

  • memory/4488-22-0x0000000000400000-0x0000000000C13000-memory.dmp
    Filesize

    8.1MB

  • memory/4488-23-0x0000000000400000-0x0000000000C13000-memory.dmp
    Filesize

    8.1MB

  • memory/4488-24-0x0000000002F70000-0x000000000316C000-memory.dmp
    Filesize

    2.0MB

  • memory/4488-32-0x0000000000400000-0x0000000000C13000-memory.dmp
    Filesize

    8.1MB

  • memory/4488-38-0x0000000000400000-0x0000000000C13000-memory.dmp
    Filesize

    8.1MB