f7ecfaeac5396a71dfb3d37217125df96e854c2920da7d474184145445f13896

Analysis

max time kernel
151s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21-05-2022 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BANK_STA.exe
Size

339KB
MD5

c9b0c4cb22b9f6ca2ba4e65a6ddd3f85
SHA1

1db3cc412c6785f5380dc3dd62d8532b6e306ef6
SHA256

2fdf0daf15395bf89c3baab2efff427dd7026ba306bb5c77c5f5598f5c6eb30f
SHA512

28e7992983db2edea83b57af7e3c1848ccc46ef71db3cf1ba250eba3199cea219df2899090b175f944d7315b949fbe1e876a02690bdf607aba1788a8e9f65f74

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

BANK_STA.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Run = "\"C:\\Users\\Admin\\AppData\\Local\\Run.exe\""	BANK_STA.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

BANK_STA.exe

pid	process
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe
1960	BANK_STA.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

BANK_STA.exe

description pid process

Token: SeDebugPrivilege 1960 BANK_STA.exe

description	pid	process
Token: SeDebugPrivilege	1960	BANK_STA.exe

C:\Users\Admin\AppData\Local\Temp\BANK_STA.exe
"C:\Users\Admin\AppData\Local\Temp\BANK_STA.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-130-0x0000000000F40000-0x0000000000F9C000-memory.dmp

Filesize
368KB

Download
memory/1960-131-0x0000000005DC0000-0x0000000006364000-memory.dmp

Filesize
5.6MB

Download
memory/1960-132-0x0000000005810000-0x00000000058A2000-memory.dmp

Filesize
584KB

Download
memory/1960-133-0x00000000058C0000-0x00000000058CA000-memory.dmp

Filesize
40KB

Download
memory/1960-134-0x0000000005BE0000-0x0000000005D86000-memory.dmp

Filesize
1.6MB

Download
memory/1960-135-0x0000000008120000-0x00000000081BC000-memory.dmp

Filesize
624KB

Download
memory/1960-136-0x0000000008440000-0x00000000084A6000-memory.dmp

Filesize
408KB

Download