Overview

overview

10

Static

static

СЧЕТ-�...14.scr

windows7-x64

10

СЧЕТ-�...14.scr

windows10-2004-x64

10

Analysis

  • max time kernel
    41s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 19:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    СЧЕТ-ФАКТУРА № 000835 от 26.08.2014.scr

  • Size

    2.9MB

  • MD5

    68cbf4a764bd3da616b6426f8ee2fd42

  • SHA1

    69deb224d550f4589e10170005ad862748964b9a

  • SHA256

    be1363a19716c5e32da206ba6dcca80681152a91d67379128352655d0317b775

  • SHA512

    0b511fb4cd3bf5df846f48faf062f1245dc79697429a64d7c4854554ef088bfc36fa6ce3328eadd468e52a3f90d4775796ede7506e361a9051b149a3170d9d71

  • SSDEEP

    49152:zMtQqMq0Yya4SOHZ3+TFTdclL/4J8200q5VWy7EeNmpQ1qocB+t/5m/hN/cM/q7P:otQLLY73OH0dclL/4JoPtQAmpQ1qoc2V

Score
10/10
banloaddownloaderdropperevasiontrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\СЧЕТ-ФАКТУРА № 000835 от 26.08.2014.scr
    "C:\Users\Admin\AppData\Local\Temp\СЧЕТ-ФАКТУРА № 000835 от 26.08.2014.scr" /S
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Users\Admin\AppData\Local\Temp\СЧЕТ-ФАКТУРА № 000835 от 26.08.2014.scr
      "C:\Users\Admin\AppData\Local\Temp\СЧЕТ-ФАКТУРА № 000835 от 26.08.2014.scr" /S
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Suspicious use of SetThreadContext
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Users\Admin\AppData\Local\Temp\СЧЕТ-ФАКТУРА № 000835 от 26.08.2014.scr
        "C:\Users\Admin\AppData\Local\Temp\СЧЕТ-ФАКТУРА № 000835 от 26.08.2014.scr"
        3⤵
          PID:1960

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Virtualization/Sandbox Evasion

    1
    T1497

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Virtualization/Sandbox Evasion

    1
    T1497

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/940-107-0x0000000000405000-0x0000000000406000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-99-0x0000000000402000-0x0000000000403000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-116-0x0000000000404000-0x0000000000405000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-114-0x0000000000408000-0x0000000000409000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-59-0x00000000005E2000-0x00000000005E3000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-61-0x0000000002730000-0x000000000293C000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/940-67-0x0000000002730000-0x000000000293C000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/940-68-0x0000000002730000-0x000000000293C000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/940-96-0x0000000000401000-0x0000000000402000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-97-0x0000000000406000-0x0000000000407000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-100-0x0000000000408000-0x0000000000409000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-106-0x0000000000405000-0x0000000000406000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-102-0x0000000000406000-0x0000000000407000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-104-0x0000000000407000-0x0000000000408000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-112-0x0000000000403000-0x0000000000404000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-108-0x0000000000409000-0x000000000040A000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-55-0x0000000000000000-mapping.dmp
      Download
    • memory/940-110-0x0000000000407000-0x0000000000408000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1888-57-0x0000000000400000-0x0000000000929000-memory.dmp
      Filesize

      5.2MB

      Download
    • memory/1888-58-0x00000000025D0000-0x0000000002AF9000-memory.dmp
      Filesize

      5.2MB

      Download
    • memory/1888-54-0x00000000757E1000-0x00000000757E3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1960-132-0x000000000049CC00-mapping.dmp
      Download
    • memory/1960-119-0x0000000000400000-0x0000000000509000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1960-121-0x0000000000400000-0x0000000000509000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1960-122-0x0000000000400000-0x0000000000509000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1960-124-0x0000000000400000-0x0000000000509000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1960-126-0x0000000000400000-0x0000000000509000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1960-127-0x0000000000400000-0x0000000000509000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1960-129-0x0000000000400000-0x0000000000509000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1960-131-0x0000000000400000-0x0000000000509000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1960-118-0x0000000000400000-0x0000000000509000-memory.dmp
      Filesize

      1.0MB

      Download