banload | 0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
Size

4.4MB
MD5

4970d0955c11c640bd3616f136211e90
SHA1

05e4966f7a5da9dbc4758e72639f1497ae9a6da0
SHA256

0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08
SHA512

c02adab04a6113d57464de1698a832a299db8f20b8db0b9f546a7bcef443adb73a0875a01fa7656771ac71ad80ca56fd1d020eff71347e4a924aa9c8a904d476
SSDEEP

98304:EYSJEVsF0vujuwWxry+/r4+MYzLC2AXn7pcw39DZnH:EYZVsF0vaBcO+/hZALpc4DZnH

Score

10^/10

banload downloader dropper trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 12 IoCs

Processes:

0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C59D6F4-5624-0164-F894-395913A71C32}\ProgID	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C59D6F4-5624-0164-F894-395913A71C32}\ProgID\ = "ScriptletHandler.Automation"	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C59D6F4-5624-0164-F894-395913A71C32}	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C59D6F4-5624-0164-F894-395913A71C32}\Implemented Categories	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C59D6F4-5624-0164-F894-395913A71C32}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C59D6F4-5624-0164-F894-395913A71C32}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C59D6F4-5624-0164-F894-395913A71C32}\InprocServer32\ = "C:\\Windows\\SysWOW64\\scrobj.dll"	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C59D6F4-5624-0164-F894-395913A71C32}\InprocServer32\ThreadingModel = "Apartment"	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C59D6F4-5624-0164-F894-395913A71C32}\ = "Constructor for Scriptlet Automation Handler"	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C59D6F4-5624-0164-F894-395913A71C32}\InprocServer32	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe

description	pid	process
Token: 33	1244	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
Token: SeIncBasePriorityPrivilege	1244	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe

pid	process
1244	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
1244	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
1244	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
1244	0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08_NeikiAnalytics.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3980

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-0-0x0000000000400000-0x0000000000C13000-memory.dmp

Filesize
8.1MB

Download
memory/1244-2-0x0000000002E30000-0x000000000302C000-memory.dmp

Filesize
2.0MB

Download
memory/1244-9-0x0000000002E30000-0x000000000302C000-memory.dmp

Filesize
2.0MB

Download
memory/1244-12-0x0000000000400000-0x0000000000C13000-memory.dmp

Filesize
8.1MB

Download
memory/1244-15-0x0000000000400000-0x0000000000C13000-memory.dmp

Filesize
8.1MB

Download
memory/1244-13-0x0000000000400000-0x0000000000C13000-memory.dmp

Filesize
8.1MB

Download
memory/1244-16-0x0000000000400000-0x0000000000C13000-memory.dmp

Filesize
8.1MB

Download
memory/1244-19-0x0000000002E30000-0x000000000302C000-memory.dmp

Filesize
2.0MB

Download
memory/1244-18-0x0000000000400000-0x0000000000C13000-memory.dmp

Filesize
8.1MB

Download
memory/1244-17-0x0000000000400000-0x0000000000C13000-memory.dmp

Filesize
8.1MB

Download
memory/1244-20-0x0000000002E30000-0x000000000302C000-memory.dmp

Filesize
2.0MB

Download
memory/1244-21-0x0000000002E30000-0x000000000302C000-memory.dmp

Filesize
2.0MB

Download
memory/1244-22-0x0000000000400000-0x0000000000C13000-memory.dmp

Filesize
8.1MB

Download
memory/1244-23-0x0000000000400000-0x0000000000C13000-memory.dmp

Filesize
8.1MB

Download
memory/1244-24-0x0000000000400000-0x0000000000C13000-memory.dmp

Filesize
8.1MB

Download
memory/1244-26-0x0000000002E30000-0x000000000302C000-memory.dmp

Filesize
2.0MB

Download
memory/1244-34-0x0000000000400000-0x0000000000C13000-memory.dmp

Filesize
8.1MB

Download