Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
26-03-2024 19:49
General
-
Target
2024-03-26_58fe03e4e9588c729996fb6ef9f0e735_mafia.exe
-
Size
6.4MB
-
MD5
58fe03e4e9588c729996fb6ef9f0e735
-
SHA1
3a42f70e5d3622bd7bc082357ce0f55e4b4997e4
-
SHA256
c04f8b2fab35789ddfb55b529a3daaa4e1ca51b9e9dbf2d41218c6ebdc27d8d9
-
SHA512
a873200901b67abf816a1fda89b81883e0c5ecc63ed9285bfc2ffea3627f322ff035b6501fc4bb25da0bdb87091c8981de6a75f8d1ba6d692d365ceec6d339a3
-
SSDEEP
196608:snTHNmqCPYtHdvf/aTn/9Ts6rb867IISw:snTHNmqCPUH1naTVTn3bkI
Score
10/10
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Modifies registry class 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_58fe03e4e9588c729996fb6ef9f0e735_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_58fe03e4e9588c729996fb6ef9f0e735_mafia.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
-
Filesize
17.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
17.4MB
-
Filesize
17.4MB
-
Filesize
17.4MB
-
Filesize
17.4MB
-
Filesize
17.4MB
-
Filesize
17.4MB
-
Filesize
17.4MB
-
Filesize
17.4MB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
17.4MB
-
Filesize
1.1MB
-
Filesize
4KB