Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26-05-2024 03:57
General
-
Target
2024-05-26_ddaec9851414d47ebc2c4ff204570cd7_mafia.exe
-
Size
2.9MB
-
MD5
ddaec9851414d47ebc2c4ff204570cd7
-
SHA1
35b8c7cdc3bcc4a606b36fcbfd797de535300eeb
-
SHA256
b90ebe6b57cf9b036b6b751a2431d7b782a619dbc18ea03bdf5f5211ab312715
-
SHA512
43e889261bceb0732150e2505d351e9097b23766f1cf3965c9a33a8345f9e3ffe086c5f0833609c2b8e321f3383ba582a0ccc7e67fff8cebf4df7c0658e00321
-
SSDEEP
49152:GIBnIYp4t6oT4QLrUl43SzuXmQ7l2mCK+MTYNG0Zms3Xkp88q9ZgOC:GIBIYdQLw6iiWmXTkrlk3q9a
Score
10/10
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Modifies registry class 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_ddaec9851414d47ebc2c4ff204570cd7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_ddaec9851414d47ebc2c4ff204570cd7_mafia.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
-
Filesize
5.6MB
-
Filesize
1.9MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
1.9MB
-
Filesize
5.6MB