Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
03-11-2023 11:51
Static task
static1
Behavioral task
behavioral1
Sample
NC16.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NC16.exe
Resource
win10v2004-20231020-en
General
-
Target
NC16.exe
-
Size
4.9MB
-
MD5
c0904cd63f384b0dbd3ccca1fa165d5e
-
SHA1
b452e402dfa645ddfd824d048ee40ecf3b2ae238
-
SHA256
9d489f5786fa90eb5ad3d700289db9c7bea05c2f5a56a7579b4069b2ab7c55b3
-
SHA512
7d1189d4c5b0b93f6ab5f85f1c8d6d18ba7557c255dd5a5b12212ca3f6d22c6c9fa09b0ab8b469feac068456cf946d78ca372c13a6d6db75673bef489b462bed
-
SSDEEP
98304:XKLSjB8AVupTy5xCysv0/vUyfihbsfU5JAUxSEoR:XoSNzMphOU/YfU5JAUxJg
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
NC16.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion NC16.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate NC16.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 5 IoCs
Processes:
NC16.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1A64FB64-EF82-F4D4-8501-54B0C04E1E61}\InprocServer32\ThreadingModel = "Apartment" NC16.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1A64FB64-EF82-F4D4-8501-54B0C04E1E61} NC16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1A64FB64-EF82-F4D4-8501-54B0C04E1E61}\ = "OutlookMessageMoniker" NC16.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1A64FB64-EF82-F4D4-8501-54B0C04E1E61}\InprocServer32 NC16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1A64FB64-EF82-F4D4-8501-54B0C04E1E61}\InprocServer32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\OUTLRPC.DLL" NC16.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NC16.exedescription pid process Token: 33 2752 NC16.exe Token: SeIncBasePriorityPrivilege 2752 NC16.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
NC16.exepid process 2752 NC16.exe 2752 NC16.exe