Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    17-02-2024 10:47

General

  • Target

    2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe

  • Size

    1.9MB

  • MD5

    d5cdd366da8ff7b7dcda895273f7aad4

  • SHA1

    24607364390995311078195f3c294c5eb849d650

  • SHA256

    4864b090370fa294424ee677b31d5f938de11e28601159967b905d447b480cfd

  • SHA512

    390a2749a7f9c2f9d252718619aaaccede5b0d06f7b3d792427a8abdd5b7303a43ef73af9bf3883f867d1403c1ec1801859c9ca9eccfd6403f640f3b78b04e5c

  • SSDEEP

    49152:TOBaLa0w/ZMlSbB9K/TTfZAKRiWsMw0eoaR3joQBTy:TOBaLa0wRQSbgiK0udaRDBTy

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Users\Admin\AppData\Local\Temp\2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2352-0-0x0000000000400000-0x000000000061E000-memory.dmp

    Filesize

    2.1MB

  • memory/2352-27-0x0000000000400000-0x000000000061E000-memory.dmp

    Filesize

    2.1MB

  • memory/2352-2-0x00000000022F0000-0x000000000250E000-memory.dmp

    Filesize

    2.1MB

  • memory/3044-17-0x0000000002A70000-0x0000000002A85000-memory.dmp

    Filesize

    84KB

  • memory/3044-3-0x0000000002410000-0x000000000261D000-memory.dmp

    Filesize

    2.1MB

  • memory/3044-10-0x0000000002410000-0x000000000261D000-memory.dmp

    Filesize

    2.1MB

  • memory/3044-15-0x0000000000400000-0x000000000061E000-memory.dmp

    Filesize

    2.1MB

  • memory/3044-16-0x0000000000400000-0x000000000061E000-memory.dmp

    Filesize

    2.1MB

  • memory/3044-4-0x0000000000400000-0x000000000061E000-memory.dmp

    Filesize

    2.1MB

  • memory/3044-18-0x0000000000400000-0x000000000061E000-memory.dmp

    Filesize

    2.1MB

  • memory/3044-20-0x0000000000400000-0x000000000061E000-memory.dmp

    Filesize

    2.1MB

  • memory/3044-21-0x0000000002410000-0x000000000261D000-memory.dmp

    Filesize

    2.1MB

  • memory/3044-23-0x0000000002410000-0x000000000261D000-memory.dmp

    Filesize

    2.1MB

  • memory/3044-1-0x0000000000400000-0x000000000061E000-memory.dmp

    Filesize

    2.1MB

  • memory/3044-26-0x0000000000400000-0x000000000061E000-memory.dmp

    Filesize

    2.1MB

  • memory/3044-28-0x0000000002410000-0x000000000261D000-memory.dmp

    Filesize

    2.1MB