Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21-05-2024 16:48
General
-
Target
5fc25a7484d832b7c60ff1bc9c3e844e9b2c0bdd98023ffc05e512edb4c6b86e.exe
-
Size
19.2MB
-
MD5
0e4924ada6cf54c65ad1e7452a002acc
-
SHA1
70de4a435716aefae28f646eb38cc1669dd96782
-
SHA256
5fc25a7484d832b7c60ff1bc9c3e844e9b2c0bdd98023ffc05e512edb4c6b86e
-
SHA512
3f98aaa9c234e359f8fa305058cf2dc0001417a985a44c0e72b0462bc5bbd45addf85acf0f670893a40591bc7aa8b8152c56e3f5d0909b2977066802eb476926
-
SSDEEP
393216:RaVxxnA/agezlwdj+KyN4+XBhu/rJwWhWfmxXwga+Zs3pbwMbcS8QBlZj/:Gx4afzKdj2LSrJwlmxXwga+u3pbJCilp
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
N/A. 11 IoCs
N/A.
-
Modifies Internet Explorer settings 1 TTPs 5 IoCs
-
Modifies registry class 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fc25a7484d832b7c60ff1bc9c3e844e9b2c0bdd98023ffc05e512edb4c6b86e.exe"C:\Users\Admin\AppData\Local\Temp\5fc25a7484d832b7c60ff1bc9c3e844e9b2c0bdd98023ffc05e512edb4c6b86e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5279eb7e962e728b96852e4dd92669620
SHA198424d24237334f89f6b3f8c349435d1d31d3816
SHA256054e0c32b5a9ce4a5d42115e41935a854f68790c439e6f59ddb8fd7bbe17298c
SHA5121daf4b15e289fa4c3922b55d242932e4957271d10a8531eb6c30e218bcce2fb851a45f0e8f868a60b2479718dc66ab7f83713812da40e46decb96de61718b730
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
2.0MB
-
Filesize
68.9MB
-
Filesize
2.0MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
2.0MB
-
Filesize
68.9MB
-
Filesize
2.0MB
-
Filesize
68.9MB