Analysis

  • max time kernel
    152s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-11-2023 05:27

General

  • Target

    29a171d1d4c17ff97b1ce9251f26489bad380babd8723c558de500b0cdc4c01e.exe

  • Size

    3.0MB

  • MD5

    b8638cdb7a22b2553b8ef8a042b15719

  • SHA1

    8eb74ad7dac04a206c6973c79c0e8b1a1661e3d5

  • SHA256

    29a171d1d4c17ff97b1ce9251f26489bad380babd8723c558de500b0cdc4c01e

  • SHA512

    14f2bf7fe4f4c06432b37bcef57c50393212697c4b4b4bc572de2bb530e89310666736993583bee7def7cb65293f32041803f0bcaf8fb4ad1c6dadd22e969123

  • SSDEEP

    49152:/pbRm4GPK/Ma2XWsTUePHnCQiRC/3poVDn99c1/0VX+me8xSZ15tL:h1GS/SWcH4g/5uDnu0VX+mzxMtL

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29a171d1d4c17ff97b1ce9251f26489bad380babd8723c558de500b0cdc4c01e.exe
    "C:\Users\Admin\AppData\Local\Temp\29a171d1d4c17ff97b1ce9251f26489bad380babd8723c558de500b0cdc4c01e.exe"
    1⤵
    • Checks BIOS information in registry
    • Registers COM server for autorun
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3624
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:1688
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3708

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3624-0-0x0000000002680000-0x000000000286A000-memory.dmp

      Filesize

      1.9MB

    • memory/3624-7-0x0000000002680000-0x000000000286A000-memory.dmp

      Filesize

      1.9MB

    • memory/3624-12-0x0000000140000000-0x000000014048D000-memory.dmp

      Filesize

      4.6MB

    • memory/3624-13-0x0000000140000000-0x000000014048D000-memory.dmp

      Filesize

      4.6MB

    • memory/3624-14-0x0000000140000000-0x000000014048D000-memory.dmp

      Filesize

      4.6MB

    • memory/3624-15-0x0000000002680000-0x000000000286A000-memory.dmp

      Filesize

      1.9MB

    • memory/3624-17-0x0000000002E90000-0x0000000002E91000-memory.dmp

      Filesize

      4KB

    • memory/3624-18-0x0000000002680000-0x000000000286A000-memory.dmp

      Filesize

      1.9MB

    • memory/3624-19-0x0000000140000000-0x000000014048D000-memory.dmp

      Filesize

      4.6MB

    • memory/3624-21-0x0000000140000000-0x000000014048D000-memory.dmp

      Filesize

      4.6MB

    • memory/3708-22-0x000001AB70940000-0x000001AB70950000-memory.dmp

      Filesize

      64KB

    • memory/3708-38-0x000001AB70A40000-0x000001AB70A50000-memory.dmp

      Filesize

      64KB

    • memory/3708-54-0x000001AB78D40000-0x000001AB78D41000-memory.dmp

      Filesize

      4KB

    • memory/3708-56-0x000001AB78D70000-0x000001AB78D71000-memory.dmp

      Filesize

      4KB

    • memory/3708-57-0x000001AB78D70000-0x000001AB78D71000-memory.dmp

      Filesize

      4KB

    • memory/3708-58-0x000001AB78E80000-0x000001AB78E81000-memory.dmp

      Filesize

      4KB