Resubmissions

Analysis

  • max time kernel
    89s
  • max time network
    95s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-06-2024 19:19

General

  • Target

    Setup.exe

  • Size

    15.1MB

  • MD5

    679e3f0e646a1a26b3264d08f398b228

  • SHA1

    feedf0799a22cdfb393960a2b8edc06b35019664

  • SHA256

    3e79d4e30a37e43e13033008ca5bfe51b54e12d24c8dbba76da259d26789b9f1

  • SHA512

    46038281c1c73ba9a0265db68a4be35fee3fb640d95c04407424a9cd7bc97013ca5b40ae546f7e25dc77c9d047ee9d4fea98d54e1c7a44977f204623543af99f

  • SSDEEP

    393216:A8+b3itt/k6pMm/aGib3gQuq6C2CT9U3TC6dRR8H0ZH3P:qS9CmqzTGunIH3P

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 9 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 48 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:860
    • C:\Users\Admin\AppData\Local\Temp\is-NMBU6.tmp\Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NMBU6.tmp\Setup.tmp" /SL5="$6022A,11439742,799232,C:\Users\Admin\AppData\Local\Temp\Setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3468
      • C:\Users\Admin\AppData\Local\Temp\Setup.exe
        "C:\Users\Admin\AppData\Local\Temp\Setup.exe" /VERYSILENT
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4800
        • C:\Users\Admin\AppData\Local\Temp\is-53MTD.tmp\Setup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-53MTD.tmp\Setup.tmp" /SL5="$7022A,11439742,799232,C:\Users\Admin\AppData\Local\Temp\Setup.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2192
          • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\UnRAR.exe
            "C:\Users\Admin\AppData\Local\\Managebg_QEE_v3\\CurrentVersion\\bin\\\UnRAR.exe" x -p2024 -o+ "C:\Users\Admin\AppData\Local\\Managebg_QEE_v3\\CurrentVersion\\bin\\\jhgfdsa.rar" "C:\Users\Admin\AppData\Local\\Managebg_QEE_v3\\CurrentVersion\\bin\\"
            5⤵
            • Executes dropped EXE
            PID:1876
          • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\ezcd.exe
            "C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\ezcd.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:460
            • C:\Users\Admin\AppData\Roaming\cpprest141_2_8\ezcd.exe
              C:\Users\Admin\AppData\Roaming\cpprest141_2_8\ezcd.exe
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Modifies registry class
              • NTFS ADS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:4460
              • C:\Windows\SysWOW64\more.com
                C:\Windows\SysWOW64\more.com
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of WriteProcessMemory
                PID:3132
                • C:\Users\Admin\AppData\Local\Temp\Ftur.au3
                  C:\Users\Admin\AppData\Local\Temp\Ftur.au3
                  8⤵
                  • Loads dropped DLL
                  PID:1436

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Licenses\01D69EEBF42E950EA.Lic

    Filesize

    146B

    MD5

    0ea9857f920983415210f3d64967a808

    SHA1

    b33a4907c93626148537b267ea161ba60ac7a858

    SHA256

    61eef2c91c1aaab3bc0c81b7a7b3a2680c9bf6694722ba0df6d12e37596e90fc

    SHA512

    f81dbfb35406471f20969ba68f38b0237b9002a4a6d592a47a3d809e586a6947d1cf32ab6b1cff5a84d7a760e995b27a3dc6f364c848ba4e4eed9ac10fcfe0a4

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\UnRAR.exe

    Filesize

    494KB

    MD5

    98ccd44353f7bc5bad1bc6ba9ae0cd68

    SHA1

    76a4e5bf8d298800c886d29f85ee629e7726052d

    SHA256

    e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b

    SHA512

    d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\acdbase.dll

    Filesize

    2.9MB

    MD5

    b1bdb6ded9dff296ceff241fb196457b

    SHA1

    5bdfb243477cf12c239bb277cd66ca0dfa5d043d

    SHA256

    a9e79f83f81567cef62d2026ce30e1d5da27352590a6ef1c662cd1a634f73352

    SHA512

    3ba56cca93ed41fd185d81b076146064e1f59d4b3109dd44ecbe26e28e669011562527b7a2bdea0d9fb2f00d03a03c80acc83b6d3430721f0ce57b7c31c36123

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    25KB

    MD5

    9f812bd3815909e559b15cb13489f294

    SHA1

    df751c956f59b4e3c82496d86895adc7cc1a1619

    SHA256

    ce6fcc2ddf21720c92bee04f5736a4787acffa970a1b0dbeea39ff5efec52c75

    SHA512

    0a360e8b81bf80cb6bdf240d627ddcf71b1a4ca42759de61b2d27fab521a8e6e3afa308cc69caf5a7c8b14d98d3d448f0d400ae1826cbe7d0f0ceafd14682064

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-environment-l1-1-0.dll

    Filesize

    21KB

    MD5

    1a72e5f24214eb723e03a22ff53f8a22

    SHA1

    578d1dbfb22e9ff3b10c095d6a06acaf15469709

    SHA256

    fda46141c236a11054d4d3756a36da4412c82dd7877daad86cb65bf53d81ca1a

    SHA512

    530e693daecc7c7080b21e39b856c538bb755516aafdb6839a23768f40bcfc38d71b19586e8c8e37bb1c2b7a7c31fcb8e24a2315a8dd90f50fec22f973d86cb4

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    21KB

    MD5

    9d136bbecf98a931e6371346059b5626

    SHA1

    2466e66bfd88dd66c1c693cbb95ea8a91b9558cd

    SHA256

    7617838af1b589f57e4fe9fee1e1412101878e6d3287cdc52a51cd03e3983717

    SHA512

    8c720c798d2a06f48b106a0a1ef38be9b4a2aebe2a657c8721278afa9fdbab9da2a672f47b7996ca1ce7517015d361d77963c686e0ae637a98c32fd75e5d0610

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    25KB

    MD5

    6b39d005deb6c5ef2c9dd9e013b32252

    SHA1

    79a0736454befd88ba8d6bd88794d07712e38a67

    SHA256

    b0e50572eb82a46ed499775e95bfde7cb25c498957432c18c20cf930f332efd0

    SHA512

    50bc1f669499589a480379d72166dae701914427d51223994d63a0363420ca6fdde07010803270a62451afea9e4ae55206d8a4c00ca4680e7a9120cd33f99a0f

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    25KB

    MD5

    97f24295c9bd6e1acae0c391e68a64cf

    SHA1

    75700dce304c45ec330a9405523f0f22e5dcbb18

    SHA256

    189d551fb3cba3dbb9b9c1797e127a52ac486d996f0ac7cba864fe35984a8d28

    SHA512

    cac75f623545c41b2597a25c14f2af7eb93e3e768b345d3b0e1928d8fd1f12bec39b18b8277f9550aa6a66d9cfe1bf6c3db93ae1eb2a6c07019d4f210b3e5998

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    25KB

    MD5

    d282a4fa046d05d40d138cc68c518914

    SHA1

    d5012090399f405ffe7d2fed09650e3544528322

    SHA256

    8b1471101145343da5f2c5981c515da4dfae783622ed71d40693fe59c3088d7a

    SHA512

    718926e728627f67ba60a391339b784accd861a15596f90d7f4e6292709ac3d170bcbca3cbf6267635136cb00b4f93da7dfd219fa0beee0cf8d95ce7090409e4

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    21KB

    MD5

    6d35a57a6d8d569f870b96e00e7f1f4d

    SHA1

    8407bdb3cd5ec15b2ce738b3dbd704aa289ce3e1

    SHA256

    f41511e477a164eb9451ca51fb3810437f3b15f21e6f5c6ce0956e84ec823723

    SHA512

    4317b86d32ca93e5f0d832819cf1ab8af68e853a19eb07dd1fa4d168a0b2a8eab309194884ed3a613b09fc6d511be872a053f76f00ea443499006cdd226fea8f

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    21KB

    MD5

    8ed70910380aa0b28317512d72762cc0

    SHA1

    0421518370f24f9559f96459d0798d98b81ea732

    SHA256

    f15af0db93d9385ff9d8efdc06aacd0729d0dfcb66e91ca0243bb160f2ed89d0

    SHA512

    b31ef07eaac310fdd3df3546246e7dc696595b8e92141e3db79a44ddc3358b12129e3829a53c76d0fef214e3f29dba77fa5d556211830a140ea34ff62258d9d7

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\ezcd.exe

    Filesize

    8.5MB

    MD5

    98169506fec94c2b12ba9930ad704515

    SHA1

    bce662a9fb94551f648ba2d7e29659957fd6a428

    SHA256

    9b8a5b0a45adf843e24214b46c285e44e73bc6eaf9e2a3b2c14a6d93ae541363

    SHA512

    7f4f7ac2326a1a8b7afc72822dae328753578eb0a4ffcec5adb4e4fb0c49703070f71e7411df221ee9f44d6b43a0a94921fe530877c5d5e71640b807e96def30

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\gable.flv

    Filesize

    46KB

    MD5

    e1e1bf5a99a816a279d1309d61d80f2d

    SHA1

    427726ac33db371d40a687ef11b6071239bc70f6

    SHA256

    317cd902474c2dd27c9ad4af84d6b97b2831a996d9cd05ce2fb2518ffc38f923

    SHA512

    a6a2807324218eb28039bf3f946f3fadcdf5507b1d85c126a55b94c07c048a43db26183692e3e385680c299b01f4666f2ab17fc366f946fd6097e3d71e46088d

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\jhgfdsa.rar

    Filesize

    9.7MB

    MD5

    d4cf9207c2e3ba875410515927a9c3b2

    SHA1

    1564182a98cbf350c3d0e6ecfdcd622226c6217f

    SHA256

    ec329b9da2c72d3dd84d0b8f41b2ba8c2e95208aa614c6f10ca2ede6e6d2b52b

    SHA512

    b7b7e96d3c0ce2286b3ebcb978b976aaf31674c204f8c868daa9019b61e67cee4b4c0da90aa1ed8463474c9a156880cc422719ae7a78617ee5d7cda0be4a5034

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\libmmd.dll

    Filesize

    4.0MB

    MD5

    42943c6acaf8d5ca953911b2bb99fc14

    SHA1

    ea719eafd2857b43b20228827f5596f1137ac3d5

    SHA256

    427ef018d494bf6cb8531ab3bbcb501ed4c8c7c6479097b33ab4d15750eccc4c

    SHA512

    85e71abc6db8a2e4eaad70d35ca613a918046715c8447b4c975021791f160aa3d1c4cb19969f81dd7b9f98f13dec41619c44e3c5948ae593af9c3d0cfec346fc

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\shroff.rtf

    Filesize

    1.3MB

    MD5

    976de7d9e2ddca3c71bc51dc64e8ea6f

    SHA1

    2a76dc465078e110b20287730b64176ce844ab9f

    SHA256

    47a827e4291894470af7ad714fcafda799ad69715100e28cbc5570801c8dbdb8

    SHA512

    804a41d05e0ebad7803a039d94a2b79a0b22340faaf6ec6aa773e67f34cf6fe5439aa8621761e30e65631ee083feea36a2f482b4614e5173e5669a756a419763

  • C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\vcruntime140.dll

    Filesize

    116KB

    MD5

    699dd61122d91e80abdfcc396ce0ec10

    SHA1

    7b23a6562e78e1d4be2a16fc7044bdcea724855e

    SHA256

    f843cd00d9aff9a902dd7c98d6137639a10bd84904d81a085c28a3b29f8223c1

    SHA512

    2517e52f7f03580afd8f928c767d264033a191e831a78eed454ea35c9514c0f0df127f49a306088d766908af7880f713f5009c31ce6b0b1e4d0b67e49447bfff

  • C:\Users\Admin\AppData\Local\Temp\Ftur.au3

    Filesize

    872KB

    MD5

    c56b5f0201a3b3de53e561fe76912bfd

    SHA1

    2a4062e10a5de813f5688221dbeb3f3ff33eb417

    SHA256

    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

    SHA512

    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

  • C:\Users\Admin\AppData\Local\Temp\d0432b6b

    Filesize

    1.8MB

    MD5

    6ecc3975be5f5af8f2088a38b881920b

    SHA1

    949099cc174542bc1b4bd36af162dfa68dae8e1c

    SHA256

    c1e6139f1565f0933b7b1e9646703eb4e8e25f15bc2adfd14ab902916a07ce17

    SHA512

    ba0f3941d3665fb1daeff33dcf8f3ad82c0f47e5d4eaf72369a88bd190b6455c9bfc33b637fa2b6d5575b580c0e97d1984322ba9aa78656aa0c44c7c27c45cac

  • C:\Users\Admin\AppData\Local\Temp\is-NMBU6.tmp\Setup.tmp

    Filesize

    3.0MB

    MD5

    62c2965912072266823bafdec2273528

    SHA1

    a737d8b8d31a440137894c0852c71976d64fb6fc

    SHA256

    d26099f9c70cd8a482e372523b96cdd5e01ff373725d786c9b9dd9749d3a03ab

    SHA512

    2dd306f9e3d78a6531b1bdd28ecc5be118bd45b3fad6197d404ab3dbadae60902fedf5df3cd8db2e07e63e5d80e672d6693b6e74c5df01a25d962ec912631c46

  • C:\Users\Admin\AppData\Local\Temp\is-OHE16.tmp\_isetup\_iscrypt.dll

    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • memory/460-97-0x00007FFC0B470000-0x00007FFC0B5EA000-memory.dmp

    Filesize

    1.5MB

  • memory/460-68-0x0000000004040000-0x0000000004228000-memory.dmp

    Filesize

    1.9MB

  • memory/460-85-0x0000000000400000-0x0000000001CF7000-memory.dmp

    Filesize

    25.0MB

  • memory/460-83-0x0000000000400000-0x0000000001CF7000-memory.dmp

    Filesize

    25.0MB

  • memory/460-84-0x0000000000400000-0x0000000001CF7000-memory.dmp

    Filesize

    25.0MB

  • memory/460-82-0x0000000000400000-0x0000000001CF7000-memory.dmp

    Filesize

    25.0MB

  • memory/460-79-0x0000000000400000-0x0000000001CF7000-memory.dmp

    Filesize

    25.0MB

  • memory/460-88-0x0000000000400000-0x0000000001CF7000-memory.dmp

    Filesize

    25.0MB

  • memory/460-86-0x0000000000400000-0x0000000001CF7000-memory.dmp

    Filesize

    25.0MB

  • memory/860-19-0x0000000000400000-0x00000000004D0000-memory.dmp

    Filesize

    832KB

  • memory/860-0-0x0000000000400000-0x00000000004D0000-memory.dmp

    Filesize

    832KB

  • memory/860-2-0x0000000000401000-0x00000000004B7000-memory.dmp

    Filesize

    728KB

  • memory/1436-163-0x00007FFC1A160000-0x00007FFC1A369000-memory.dmp

    Filesize

    2.0MB

  • memory/1436-165-0x0000000000160000-0x00000000001B9000-memory.dmp

    Filesize

    356KB

  • memory/2192-67-0x0000000000400000-0x000000000070C000-memory.dmp

    Filesize

    3.0MB

  • memory/3132-155-0x00007FFC1A160000-0x00007FFC1A369000-memory.dmp

    Filesize

    2.0MB

  • memory/3132-157-0x00000000751C0000-0x000000007533D000-memory.dmp

    Filesize

    1.5MB

  • memory/3468-10-0x0000000000400000-0x000000000070C000-memory.dmp

    Filesize

    3.0MB

  • memory/3468-16-0x0000000000400000-0x000000000070C000-memory.dmp

    Filesize

    3.0MB

  • memory/4460-137-0x0000000000400000-0x0000000001CF7000-memory.dmp

    Filesize

    25.0MB

  • memory/4460-141-0x0000000000400000-0x0000000001CF7000-memory.dmp

    Filesize

    25.0MB

  • memory/4460-138-0x0000000000400000-0x0000000001CF7000-memory.dmp

    Filesize

    25.0MB

  • memory/4460-142-0x0000000000400000-0x0000000001CF7000-memory.dmp

    Filesize

    25.0MB

  • memory/4460-151-0x00007FFC0B470000-0x00007FFC0B5EA000-memory.dmp

    Filesize

    1.5MB

  • memory/4460-139-0x0000000000400000-0x0000000001CF7000-memory.dmp

    Filesize

    25.0MB

  • memory/4460-152-0x00007FFC0B470000-0x00007FFC0B5EA000-memory.dmp

    Filesize

    1.5MB

  • memory/4460-122-0x0000000003EC0000-0x00000000040A8000-memory.dmp

    Filesize

    1.9MB

  • memory/4460-135-0x0000000000400000-0x0000000001CF7000-memory.dmp

    Filesize

    25.0MB

  • memory/4460-133-0x0000000000400000-0x0000000001CF7000-memory.dmp

    Filesize

    25.0MB

  • memory/4800-17-0x0000000000400000-0x00000000004D0000-memory.dmp

    Filesize

    832KB

  • memory/4800-14-0x0000000000400000-0x00000000004D0000-memory.dmp

    Filesize

    832KB

  • memory/4800-75-0x0000000000400000-0x00000000004D0000-memory.dmp

    Filesize

    832KB