Analysis
-
max time kernel
136s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
12-05-2024 11:39
General
-
Target
2024-05-12_85ba39600315e784d159e278d0d9088e_mafia.exe
-
Size
2.9MB
-
MD5
85ba39600315e784d159e278d0d9088e
-
SHA1
4c5a7ec25c5de383a11ac963ce17c0b438e370d3
-
SHA256
a624ed5d8480d4a462ada28966364e8d3f58bca95a31827773aa3c79bb27ef65
-
SHA512
d3ce015755019ccfb5993fe6b947b39c86f36a846bf1b599bb2e4d1f2525b9fbca98ded3701e40834bdc5b486686c5d452f8d06d0973193b8855fe31c670ce3c
-
SSDEEP
49152:BArprNIIL2oT8we5x8qWNLrdrAoWH2mCK+/9z+KL0jhGGNKNA/QXHboxXXzs:BArFNywe52VphPmw5lHP0tXzs
Score
10/10
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Modifies registry class 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-12_85ba39600315e784d159e278d0d9088e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-12_85ba39600315e784d159e278d0d9088e_mafia.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
-
Filesize
6.1MB
-
Filesize
1.9MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
128KB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
1.9MB
-
Filesize
6.1MB