d420da458ca2f642d7f541219cc71ddea42f236c7889c04de4733f08d9b89170

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BananaBot.exe
Size

2.7MB
MD5

8063181c476db09b6cc2df0d31e36559
SHA1

26e1303e7599d11977ecbde0885a63f6b32b7086
SHA256

d420da458ca2f642d7f541219cc71ddea42f236c7889c04de4733f08d9b89170
SHA512

b56da66f2f9c7f992e5fc4572645fd8e5287a6b54e9affe9d6484bfd2a7c936450a60b705edf566fe57a4b2e175be1f36b284500c6c39ef93695cf73bef5e533
SSDEEP

49152:vDjlabwz9XDjlabwz9ngfAM7tzqosdnzrL+QppFj97enzGsz4QX:bqwBqwhAAo4zWKZ7ef4Q

Score

7^/10

spyware stealer vmprotect

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cola.exelpobnta.exeBananaBot.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	cola.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	lpobnta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	BananaBot.exe

Executes dropped EXE 3 IoCs

Processes:

cola.exelpobnta.exeSystem.exe

pid process

840 cola.exe
3184 lpobnta.exe
2708 System.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\RarSFX1\lpobnta.exe vmprotect
behavioral1/memory/3184-22-0x0000000000130000-0x00000000003EC000-memory.dmp vmprotect

pid	process
840	cola.exe
3184	lpobnta.exe
2708	System.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX1\lpobnta.exe	vmprotect
behavioral1/memory/3184-22-0x0000000000130000-0x00000000003EC000-memory.dmp	vmprotect

Drops file in Program Files directory 4 IoCs

Processes:

lpobnta.exe

description	ioc	process
File created	C:\Program Files\Mozilla Firefox\fontdrvhost.exe	lpobnta.exe
File created	C:\Program Files\Mozilla Firefox\5b884080fd4f94	lpobnta.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\sppsvc.exe	lpobnta.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0a1fd5f707cd16	lpobnta.exe

Drops file in Windows directory 4 IoCs

Processes:

lpobnta.exe

description	ioc	process
File created	C:\Windows\ja-JP\System.exe	lpobnta.exe
File created	C:\Windows\ja-JP\27d1bcfc3c54e0	lpobnta.exe
File created	C:\Windows\PLA\Rules\sppsvc.exe	lpobnta.exe
File created	C:\Windows\PLA\Rules\0a1fd5f707cd16	lpobnta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

lpobnta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings lpobnta.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1776 PING.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings	lpobnta.exe

pid	process
1776	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

lpobnta.exe

pid	process
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe
3184	lpobnta.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

System.exe

pid process

2708 System.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

lpobnta.exeSystem.exe

description pid process

Token: SeDebugPrivilege 3184 lpobnta.exe
Token: SeDebugPrivilege 2708 System.exe

pid	process
2708	System.exe

description	pid	process
Token: SeDebugPrivilege	3184	lpobnta.exe
Token: SeDebugPrivilege	2708	System.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

BananaBot.execmd.execola.exelpobnta.execmd.exe

description	pid	process	target process
PID 2612 wrote to memory of 4236	2612	BananaBot.exe	cmd.exe
PID 2612 wrote to memory of 4236	2612	BananaBot.exe	cmd.exe
PID 4236 wrote to memory of 840	4236	cmd.exe	cola.exe
PID 4236 wrote to memory of 840	4236	cmd.exe	cola.exe
PID 840 wrote to memory of 3184	840	cola.exe	lpobnta.exe
PID 840 wrote to memory of 3184	840	cola.exe	lpobnta.exe
PID 3184 wrote to memory of 2028	3184	lpobnta.exe	cmd.exe
PID 3184 wrote to memory of 2028	3184	lpobnta.exe	cmd.exe
PID 2028 wrote to memory of 2304	2028	cmd.exe	chcp.com
PID 2028 wrote to memory of 2304	2028	cmd.exe	chcp.com
PID 2028 wrote to memory of 1776	2028	cmd.exe	PING.EXE
PID 2028 wrote to memory of 1776	2028	cmd.exe	PING.EXE
PID 2028 wrote to memory of 2708	2028	cmd.exe	System.exe
PID 2028 wrote to memory of 2708	2028	cmd.exe	System.exe

C:\Users\Admin\AppData\Local\Temp\BananaBot.exe
"C:\Users\Admin\AppData\Local\Temp\BananaBot.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:4236

C:\Users\Admin\AppData\Local\Temp\RarSFX0\cola.exe
cola.exe -priverdD
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840

C:\Users\Admin\AppData\Local\Temp\RarSFX1\lpobnta.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\lpobnta.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8aTcuQgj5N.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\chcp.com
chcp 65001
6⤵
PID:2304

C:\Windows\system32\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:1776

C:\Windows\ja-JP\System.exe
"C:\Windows\ja-JP\System.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2736,i,11069752405888604640,8928124405695604965,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
1⤵
PID:4636

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8aTcuQgj5N.bat
Filesize
155B

MD5
d24d9c72a5eb96afa6a3e08dd5e9a7ed

SHA1
1a5db7852c70995ef11f1572b3fe0284bd8dfa03

SHA256
14e4a52106ef4dee0347bf5cc8dead26021d8180140d506d599c6acea36ae7a1

SHA512
3fb245c830d3abb040c8c7a91aed56ff0f274f5923053a30800a63ab341bcdb381e34f292eab984cf04413c229285b2a1979000d821334a7605a356038000276

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat
Filesize
35B

MD5
36e7c1d659e3073dde6db4bfb5eac618

SHA1
b4af6a3a5da137515d2eb2c54131d733dfdf72ab

SHA256
cf765bd3468a6787a00fc1b3a66109980e82c857741345ceab81ddfcbb85bd1a

SHA512
29a4b0a8faf2bdf85f291475b06c1ec7a4dfe805d1ce1bd71f1c3dbf8a7f6323af2e823cf0b51676847603db81b0d6d01d146040fec3c8ed73de29a8046dc181

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\cola.exe
Filesize
2.0MB

MD5
cb82a3529a3b74bcbcdc52c92880c2bd

SHA1
c1ab84d9771c26141348e5ce618ba78884e0f47e

SHA256
a954630e294cbeec12bb7e858accc68d6191ce5a004c1c2806f8ffbf246c0dce

SHA512
5403816bfe36f3745ed5c8182aceefc2be7eec86fd64982aa8a3b849b05471da948e26f92441a5e459b3fc09357eb8111fc738109e1e7e9760d48f89271205f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\lpobnta.exe
Filesize
1.6MB

MD5
95a81dc75ad154ae28b1d52ccb9acb3a

SHA1
f699e7a5b50d012ca7311733d824e801cf6019e5

SHA256
b4c7f2ffe3c274332fc7b4edeb4419d0fb73892a65329444a4abd26b064d08ff

SHA512
30eddb9c5ffbde94dea965cee389a889da2c0c6adc84c29d6415a2f72d31854b8c1e3ff200f609e78659515ce206d3b5318b0f040ce50ee8cea35a24432fee06

Download Submit
memory/2708-68-0x000000001BE30000-0x000000001BED9000-memory.dmp

Filesize
676KB

Download
memory/3184-31-0x000000001AF90000-0x000000001AF9E000-memory.dmp

Filesize
56KB

Download
memory/3184-27-0x000000001B360000-0x000000001B3B0000-memory.dmp

Filesize
320KB

Download
memory/3184-29-0x000000001AFD0000-0x000000001AFE8000-memory.dmp

Filesize
96KB

Download
memory/3184-26-0x000000001AFB0000-0x000000001AFCC000-memory.dmp

Filesize
112KB

Download
memory/3184-33-0x000000001AFA0000-0x000000001AFAC000-memory.dmp

Filesize
48KB

Download
memory/3184-35-0x000000001AFF0000-0x000000001AFFE000-memory.dmp

Filesize
56KB

Download
memory/3184-37-0x000000001B000000-0x000000001B00E000-memory.dmp

Filesize
56KB

Download
memory/3184-39-0x000000001B010000-0x000000001B01C000-memory.dmp

Filesize
48KB

Download
memory/3184-55-0x000000001B4B0000-0x000000001B559000-memory.dmp

Filesize
676KB

Download
memory/3184-24-0x000000001AF80000-0x000000001AF8E000-memory.dmp

Filesize
56KB

Download
memory/3184-22-0x0000000000130000-0x00000000003EC000-memory.dmp

Filesize
2.7MB

Download