Overview

overview

10

Static

static

СЧЕТ-�...14.scr

windows7-x64

10

СЧЕТ-�...14.scr

windows10-2004-x64

10

Analysis

  • max time kernel
    74s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 19:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    СЧЕТ-ФАКТУРА № 000835 от 26.08.2014.scr

  • Size

    2.9MB

  • MD5

    68cbf4a764bd3da616b6426f8ee2fd42

  • SHA1

    69deb224d550f4589e10170005ad862748964b9a

  • SHA256

    be1363a19716c5e32da206ba6dcca80681152a91d67379128352655d0317b775

  • SHA512

    0b511fb4cd3bf5df846f48faf062f1245dc79697429a64d7c4854554ef088bfc36fa6ce3328eadd468e52a3f90d4775796ede7506e361a9051b149a3170d9d71

  • SSDEEP

    49152:zMtQqMq0Yya4SOHZ3+TFTdclL/4J8200q5VWy7EeNmpQ1qocB+t/5m/hN/cM/q7P:otQLLY73OH0dclL/4JoPtQAmpQ1qoc2V

Score
10/10
banloaddownloaderdropperevasiontrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\СЧЕТ-ФАКТУРА № 000835 от 26.08.2014.scr
    "C:\Users\Admin\AppData\Local\Temp\СЧЕТ-ФАКТУРА № 000835 от 26.08.2014.scr" /S
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Users\Admin\AppData\Local\Temp\СЧЕТ-ФАКТУРА № 000835 от 26.08.2014.scr
      "C:\Users\Admin\AppData\Local\Temp\СЧЕТ-ФАКТУРА № 000835 от 26.08.2014.scr" /S
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1272
      • C:\Users\Admin\AppData\Local\Temp\СЧЕТ-ФАКТУРА № 000835 от 26.08.2014.scr
        "C:\Users\Admin\AppData\Local\Temp\СЧЕТ-ФАКТУРА № 000835 от 26.08.2014.scr"
        3⤵
          PID:4760

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Virtualization/Sandbox Evasion

    1
    T1497

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Virtualization/Sandbox Evasion

    1
    T1497

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1272-165-0x0000000000402000-0x0000000000403000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1272-171-0x0000000000405000-0x0000000000406000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1272-136-0x0000000002B70000-0x0000000002D7C000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/1272-142-0x0000000000400000-0x0000000000929000-memory.dmp
      Filesize

      5.2MB

      Download
    • memory/1272-173-0x0000000000407000-0x0000000000408000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1272-167-0x0000000000406000-0x0000000000407000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1272-134-0x0000000000000000-mapping.dmp
      Download
    • memory/1272-145-0x0000000000400000-0x0000000000929000-memory.dmp
      Filesize

      5.2MB

      Download
    • memory/1272-143-0x0000000002B70000-0x0000000002D7C000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/1272-169-0x0000000000408000-0x0000000000409000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1272-146-0x0000000002B70000-0x0000000002D7C000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/4256-144-0x0000000000400000-0x0000000000929000-memory.dmp
      Filesize

      5.2MB

      Download
    • memory/4256-133-0x0000000000400000-0x0000000000929000-memory.dmp
      Filesize

      5.2MB

      Download
    • memory/4256-179-0x0000000000400000-0x0000000000929000-memory.dmp
      Filesize

      5.2MB

      Download
    • memory/4760-175-0x0000000000000000-mapping.dmp
      Download
    • memory/4760-176-0x0000000000400000-0x0000000000509000-memory.dmp
      Filesize

      1.0MB

      Download