Analysis

  • max time kernel
    90s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/12/2022, 01:34

General

  • Target

    827fd2a5e1da22aaac8b1825653abc12625938a26745f107f300c50158fca5c8.exe

  • Size

    3.4MB

  • MD5

    fab0306db512bde42d979dcbbe160b56

  • SHA1

    e5033e09dc76aa2492e1f07618a278780e4c3644

  • SHA256

    827fd2a5e1da22aaac8b1825653abc12625938a26745f107f300c50158fca5c8

  • SHA512

    29b4def18e0a02d3e58101d9417c5c36a9c6f1dc856fa9156f30a2c606a2279639d4604a7d710b975b1780beed75c59566650453360c6d9e8f1cad08df6b9e71

  • SSDEEP

    98304:/3bq3iN5gerF2He3tDjDxH81vBN07O7EZN1op7xL+:/3b95gerF26uNJ+

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\827fd2a5e1da22aaac8b1825653abc12625938a26745f107f300c50158fca5c8.exe
    "C:\Users\Admin\AppData\Local\Temp\827fd2a5e1da22aaac8b1825653abc12625938a26745f107f300c50158fca5c8.exe"
    1⤵
    • Checks BIOS information in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:788

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/788-133-0x0000000000400000-0x0000000000802000-memory.dmp

    Filesize

    4.0MB

  • memory/788-134-0x0000000002A70000-0x0000000002C7D000-memory.dmp

    Filesize

    2.1MB

  • memory/788-140-0x0000000002A70000-0x0000000002C7D000-memory.dmp

    Filesize

    2.1MB

  • memory/788-141-0x0000000000400000-0x0000000000802000-memory.dmp

    Filesize

    4.0MB

  • memory/788-142-0x0000000000400000-0x0000000000802000-memory.dmp

    Filesize

    4.0MB

  • memory/788-143-0x0000000000400000-0x0000000000802000-memory.dmp

    Filesize

    4.0MB

  • memory/788-145-0x0000000000401000-0x000000000042A000-memory.dmp

    Filesize

    164KB

  • memory/788-146-0x0000000000401000-0x000000000042A000-memory.dmp

    Filesize

    164KB

  • memory/788-144-0x0000000000401000-0x000000000042A000-memory.dmp

    Filesize

    164KB

  • memory/788-148-0x0000000000400000-0x0000000000802000-memory.dmp

    Filesize

    4.0MB

  • memory/788-147-0x0000000000400000-0x0000000000802000-memory.dmp

    Filesize

    4.0MB

  • memory/788-149-0x0000000000400000-0x0000000000802000-memory.dmp

    Filesize

    4.0MB

  • memory/788-150-0x0000000002A70000-0x0000000002C7D000-memory.dmp

    Filesize

    2.1MB