Analysis
-
max time kernel
177s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-05-2022 15:04
Static task
static1
Behavioral task
behavioral1
Sample
366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe
Resource
win10v2004-20220414-en
General
-
Target
366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe
-
Size
2.3MB
-
MD5
aef4d0d4e46ac25b14fa4f8f301e6250
-
SHA1
476df1439391bc241d98e693ae4690beec86c26a
-
SHA256
366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b
-
SHA512
38fc6c313ff511a1b1b3216748bc8e93b0b6e4603ac80669d665ac1d2a38a7ce31bd337b82ad0f23a511d21bf2b32e0e0a21047bebeb6cdd463dd553e5b01014
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe -
Modifies registry class 5 IoCs
Processes:
366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F7D4222-7FD6-D636-8A7D-725CDC9DFF5A}\InprocServer32\ThreadingModel = "Both" 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F7D4222-7FD6-D636-8A7D-725CDC9DFF5A} 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F7D4222-7FD6-D636-8A7D-725CDC9DFF5A}\ = "PSEnumVariant" 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F7D4222-7FD6-D636-8A7D-725CDC9DFF5A}\InprocServer32 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F7D4222-7FD6-D636-8A7D-725CDC9DFF5A}\InprocServer32\ = "C:\\Windows\\SysWOW64\\oleaut32.dll" 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exedescription pid process target process PID 1656 wrote to memory of 2656 1656 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe PID 1656 wrote to memory of 2656 1656 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe PID 1656 wrote to memory of 2656 1656 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe PID 1656 wrote to memory of 2656 1656 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe PID 1656 wrote to memory of 2656 1656 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe 366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe"C:\Users\Admin\AppData\Local\Temp\366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe"C:\Users\Admin\AppData\Local\Temp\366175c7182c391e1334e48ea51dba31da4b3ab6563534af34cdfd62f776e56b.exe"2⤵
- Checks BIOS information in registry
- Modifies registry class