Analysis

  • max time kernel
    172s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2023 01:47

General

  • Target

    5212838b796f041056856765aa173efbe61fdf10b6371f6516c0ec735d701074.exe

  • Size

    4.4MB

  • MD5

    c56c5a79377a4cd550888a9701e8e0a9

  • SHA1

    60f9492b5e6fb3f8eae7c6f958e489708e898bba

  • SHA256

    5212838b796f041056856765aa173efbe61fdf10b6371f6516c0ec735d701074

  • SHA512

    8b9897df8ade413ab5f59831a2b4d41e025cca1350ac8a6512750753b42694fdce33cb3de1de53a8284ff3819257730485b9afbe6a55d873a9b5c8da3e9464bc

  • SSDEEP

    49152:raCYUCCvVWr3dvtwRTdCvOw+FtMyMpy7cxnz2Wv0D098YYsXNF4jgDvoaqsKwfcU:rHYUCCvcr3dv7OwYPWGSp0w98SNOgDY

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5212838b796f041056856765aa173efbe61fdf10b6371f6516c0ec735d701074.exe
    "C:\Users\Admin\AppData\Local\Temp\5212838b796f041056856765aa173efbe61fdf10b6371f6516c0ec735d701074.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4624-1-0x0000000004D00000-0x0000000004F0C000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-8-0x0000000004D00000-0x0000000004F0C000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-7-0x0000000004D00000-0x0000000004F0C000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-11-0x0000000000410000-0x000000000098A000-memory.dmp

    Filesize

    5.5MB

  • memory/4624-13-0x0000000000410000-0x000000000098A000-memory.dmp

    Filesize

    5.5MB

  • memory/4624-14-0x0000000000410000-0x000000000098A000-memory.dmp

    Filesize

    5.5MB

  • memory/4624-15-0x0000000000410000-0x000000000098A000-memory.dmp

    Filesize

    5.5MB

  • memory/4624-16-0x0000000000410000-0x000000000098A000-memory.dmp

    Filesize

    5.5MB

  • memory/4624-17-0x0000000004D00000-0x0000000004F0C000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-18-0x0000000004D00000-0x0000000004F0C000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-19-0x0000000004D00000-0x0000000004F0C000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-20-0x0000000004D00000-0x0000000004F0C000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-21-0x0000000000410000-0x000000000098A000-memory.dmp

    Filesize

    5.5MB