Analysis
- max time kernel
143s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
28/06/2024, 23:12
General
- Target 0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08.exe
- Size 4.4MB
- Sample240628-26yrasvcle
- SHA256 0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08
Malware Config
Signatures
- Banload
Banload variants download malicious files, then install and execute the files.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08.exe"C:\Users\Admin\AppData\Local\Temp\0ecfe044265d75308af5f4195a9dd647ae1299651a0d24c2d58c73d1c523ed08.exe"1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4488-1-0x0000000000400000-0x0000000000C13000-memory.dmp
memory/4488-2-0x0000000002F70000-0x000000000316C000-memory.dmp
memory/4488-9-0x0000000002F70000-0x000000000316C000-memory.dmp
memory/4488-12-0x0000000000400000-0x0000000000C13000-memory.dmp
memory/4488-13-0x0000000000400000-0x0000000000C13000-memory.dmp
memory/4488-15-0x0000000000400000-0x0000000000C13000-memory.dmp
memory/4488-16-0x0000000000400000-0x0000000000C13000-memory.dmp
memory/4488-17-0x0000000000400000-0x0000000000C13000-memory.dmp
memory/4488-19-0x0000000002F70000-0x000000000316C000-memory.dmp
memory/4488-18-0x0000000000400000-0x0000000000C13000-memory.dmp
memory/4488-20-0x0000000002F70000-0x000000000316C000-memory.dmp
memory/4488-22-0x0000000000400000-0x0000000000C13000-memory.dmp
memory/4488-23-0x0000000000400000-0x0000000000C13000-memory.dmp
memory/4488-24-0x0000000002F70000-0x000000000316C000-memory.dmp
memory/4488-32-0x0000000000400000-0x0000000000C13000-memory.dmp
memory/4488-38-0x0000000000400000-0x0000000000C13000-memory.dmp