Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2023 05:27
Static task
static1
Behavioral task
behavioral1
Sample
2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe
Resource
win10v2004-20231023-en
General
-
Target
2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe
-
Size
3.1MB
-
MD5
8e06bbe6799de5e89066dfa647810c5f
-
SHA1
e43fd0f0cef618c0921d45ca20996705a0672ce0
-
SHA256
2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750
-
SHA512
87d9d980a138aab47261ef74ac8ccdd7d62416d346c9bb59eb650a5ae38a9196fa0e5ab92d7d194b0e12c209839de36b0d9fe635af43d068f09b0ff10a40f2b7
-
SSDEEP
49152:45+dm/qViTSPTXJo1I/OxGRM68B1ECYJgkk9CiOme8xSZ15tL:45t/uiEJQI/OxGS68B+5JemmzxMtL
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe -
Modifies registry class 11 IoCs
Processes:
2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A6DF0E1-9BDE-5C22-E830-370D178B66F2}\InProcServer32\ThreadingModel = "Apartment" 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A6DF0E1-9BDE-5C22-E830-370D178B66F2}\ProgID\ = "SSPWorkspace.1" 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A6DF0E1-9BDE-5C22-E830-370D178B66F2}\TypeLib\ = "{94A67BDD-80F7-4E36-A15D-E8B08806A7AD}" 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A6DF0E1-9BDE-5C22-E830-370D178B66F2}\VersionIndependentProgID\ = "SSPWorkspace" 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A6DF0E1-9BDE-5C22-E830-370D178B66F2} 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A6DF0E1-9BDE-5C22-E830-370D178B66F2}\InProcServer32 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A6DF0E1-9BDE-5C22-E830-370D178B66F2}\ProgID 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A6DF0E1-9BDE-5C22-E830-370D178B66F2}\TypeLib 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A6DF0E1-9BDE-5C22-E830-370D178B66F2}\VersionIndependentProgID 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A6DF0E1-9BDE-5C22-E830-370D178B66F2}\ = "SSPWorkspace Class" 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A6DF0E1-9BDE-5C22-E830-370D178B66F2}\InProcServer32\ = "C:\\Windows\\SysWOW64\\tsworkspace.dll" 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exedescription pid process Token: 33 412 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe Token: SeIncBasePriorityPrivilege 412 2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe"C:\Users\Admin\AppData\Local\Temp\2c995b66ea51e2be03bceb99f90649f0598ee29f9d12f72ec4511d6e8b366750.exe"1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:412