Analysis
-
max time kernel
137s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
03-11-2023 11:51
Static task
static1
Behavioral task
behavioral1
Sample
NC16.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NC16.exe
Resource
win10v2004-20231020-en
General
-
Target
NC16.exe
-
Size
4.9MB
-
MD5
c0904cd63f384b0dbd3ccca1fa165d5e
-
SHA1
b452e402dfa645ddfd824d048ee40ecf3b2ae238
-
SHA256
9d489f5786fa90eb5ad3d700289db9c7bea05c2f5a56a7579b4069b2ab7c55b3
-
SHA512
7d1189d4c5b0b93f6ab5f85f1c8d6d18ba7557c255dd5a5b12212ca3f6d22c6c9fa09b0ab8b469feac068456cf946d78ca372c13a6d6db75673bef489b462bed
-
SSDEEP
98304:XKLSjB8AVupTy5xCysv0/vUyfihbsfU5JAUxSEoR:XoSNzMphOU/YfU5JAUxJg
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
NC16.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion NC16.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate NC16.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 4 IoCs
Processes:
NC16.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A64FB64-EF82-F4D4-8501-54B0C04E1E61} NC16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A64FB64-EF82-F4D4-8501-54B0C04E1E61}\ = "Shared Memory Stream Marshaller" NC16.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A64FB64-EF82-F4D4-8501-54B0C04E1E61}\InProcHandler32 NC16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A64FB64-EF82-F4D4-8501-54B0C04E1E61}\InProcHandler32\ = "%SystemRoot%\\SysWow64\\shcore.dll" NC16.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NC16.exedescription pid process Token: 33 3288 NC16.exe Token: SeIncBasePriorityPrivilege 3288 NC16.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
NC16.exepid process 3288 NC16.exe 3288 NC16.exe