Analysis
-
max time kernel
136s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 04:19
Static task
static1
Behavioral task
behavioral1
Sample
0e0b4e26f6c648e9ed3258b88d45c99c2836827832d1c43e3d07f7a8503d4b14.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0e0b4e26f6c648e9ed3258b88d45c99c2836827832d1c43e3d07f7a8503d4b14.dll
Resource
win10v2004-20230915-en
General
-
Target
0e0b4e26f6c648e9ed3258b88d45c99c2836827832d1c43e3d07f7a8503d4b14.dll
-
Size
6.0MB
-
MD5
6351414d1c6407848037859b14a7356c
-
SHA1
108892cbc26a0f6bd3a244d3b039ab50d45b4e54
-
SHA256
0e0b4e26f6c648e9ed3258b88d45c99c2836827832d1c43e3d07f7a8503d4b14
-
SHA512
66df08f82f16b5dea9b18eaf273f16a1d724a4228cb1acde8a15a5c2ab6bde83673df5a58a366217ae851fca9e895ed447bf99d781662a99290358ddca9aede1
-
SSDEEP
98304:/vPA+ra5FsuDnu0VXUg8Ln/I3gpbjPWy+9xMt/m:XPA+s7DfBUBg3gNjPH+9xk/m
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
regsvr32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate regsvr32.exe -
Registers COM server for autorun 1 TTPs 6 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1243ED3-4B27-341D-7712-354446A630B1}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1243ED3-4B27-341D-7712-354446A630B1}\InProcServer32\ = "%SystemRoot%\\system32\\shell32.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1243ED3-4B27-341D-7712-354446A630B1}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e0b4e26f6c648e9ed3258b88d45c99c2836827832d1c43e3d07f7a8503d4b14.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Modifies registry class 52 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1243ED3-4B27-341D-7712-354446A630B1}\InProcServer32\ = "%SystemRoot%\\system32\\shell32.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2010.Connect.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2010.Connect.1\ = "Connect Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20106402-AE2E-4A01-81A1-0F0BA89F8884}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20106402-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e0b4e26f6c648e9ed3258b88d45c99c2836827832d1c43e3d07f7a8503d4b14.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20106403-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20106402-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20106402-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1243ED3-4B27-341D-7712-354446A630B1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1243ED3-4B27-341D-7712-354446A630B1}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2010.Connect.1\CLSID\ = "{20106401-AE2E-4A01-81A1-0F0BA89F8884}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2010.Connect\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20106402-AE2E-4A01-81A1-0F0BA89F8884}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20106403-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20106403-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20106403-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1243ED3-4B27-341D-7712-354446A630B1}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2010.Connect.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\AppID = "{20106401-AE2E-4A01-81A1-0F0BA89F8884}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\ProgID\ = "NoteGem2010.Connect.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e0b4e26f6c648e9ed3258b88d45c99c2836827832d1c43e3d07f7a8503d4b14.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20106402-AE2E-4A01-81A1-0F0BA89F8884} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20106403-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20106402-AE2E-4A01-81A1-0F0BA89F8884}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1243ED3-4B27-341D-7712-354446A630B1}\ = "Remove Properties Drop Target" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20106402-AE2E-4A01-81A1-0F0BA89F8884}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20106403-AE2E-4A01-81A1-0F0BA89F8884} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2010.Connect\CurVer\ = "NoteGem2010.Connect.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20106403-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20106403-AE2E-4A01-81A1-0F0BA89F8884}\ = "IConnect" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20106403-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2010.Connect\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2010.Connect\CLSID\ = "{20106401-AE2E-4A01-81A1-0F0BA89F8884}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20106402-AE2E-4A01-81A1-0F0BA89F8884}\1.0\ = "Note Gem 2010 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20106402-AE2E-4A01-81A1-0F0BA89F8884}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20106402-AE2E-4A01-81A1-0F0BA89F8884}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20106403-AE2E-4A01-81A1-0F0BA89F8884}\ = "IConnect" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20106403-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20106403-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20106402-AE2E-4A01-81A1-0F0BA89F8884}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20106403-AE2E-4A01-81A1-0F0BA89F8884} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2010.Connect regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2010.Connect\ = "Connect Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\VersionIndependentProgID\ = "NoteGem2010.Connect" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20106402-AE2E-4A01-81A1-0F0BA89F8884}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20106401-AE2E-4A01-81A1-0F0BA89F8884}\ = "Connect Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20106403-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
regsvr32.exedescription pid process Token: 33 2252 regsvr32.exe Token: SeIncBasePriorityPrivilege 2252 regsvr32.exe