Analysis

  • max time kernel
    118s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    31-10-2023 15:29

General

  • Target

    a1e7648535ccc5a8d07d131da0b49bb2db3d5ef58dff4665bc6ad76efbc6dce6.exe

  • Size

    2.2MB

  • MD5

    7c4d226a7f57c5dc1b17b1a1f2f6ee9b

  • SHA1

    37d9730dd544572fb7713b6fdcb8204773921dca

  • SHA256

    a1e7648535ccc5a8d07d131da0b49bb2db3d5ef58dff4665bc6ad76efbc6dce6

  • SHA512

    3010049f95261297ab9e0fd4c15a06bf11835c07591cb40c32ff2407587da06aeabecee0bfd36487be07f31f1fb4b400d9e0b95143e4d29a23d0dbad5ef7e345

  • SSDEEP

    49152:p2gYP6qky5WWTEPI7loWRBaG68B1ECYJgkh6NVN+:p2fP6DyYPqloWRBN68B+5Jn6NVY

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1e7648535ccc5a8d07d131da0b49bb2db3d5ef58dff4665bc6ad76efbc6dce6.exe
    "C:\Users\Admin\AppData\Local\Temp\a1e7648535ccc5a8d07d131da0b49bb2db3d5ef58dff4665bc6ad76efbc6dce6.exe"
    1⤵
    • Checks BIOS information in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:1364

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1364-0-0x0000000000400000-0x00000000006D2000-memory.dmp

    Filesize

    2.8MB

  • memory/1364-1-0x0000000002470000-0x0000000002671000-memory.dmp

    Filesize

    2.0MB

  • memory/1364-7-0x0000000002470000-0x0000000002671000-memory.dmp

    Filesize

    2.0MB

  • memory/1364-12-0x0000000000400000-0x00000000006D2000-memory.dmp

    Filesize

    2.8MB

  • memory/1364-13-0x0000000000400000-0x00000000006D2000-memory.dmp

    Filesize

    2.8MB

  • memory/1364-14-0x0000000000400000-0x00000000006D2000-memory.dmp

    Filesize

    2.8MB

  • memory/1364-15-0x0000000000400000-0x00000000006D2000-memory.dmp

    Filesize

    2.8MB

  • memory/1364-16-0x0000000000400000-0x00000000006D2000-memory.dmp

    Filesize

    2.8MB

  • memory/1364-17-0x0000000002470000-0x0000000002671000-memory.dmp

    Filesize

    2.0MB

  • memory/1364-19-0x0000000000770000-0x0000000000771000-memory.dmp

    Filesize

    4KB

  • memory/1364-20-0x0000000002470000-0x0000000002671000-memory.dmp

    Filesize

    2.0MB

  • memory/1364-22-0x0000000000400000-0x00000000006D2000-memory.dmp

    Filesize

    2.8MB