Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
05-08-2024 19:31
General
-
Target
2024-08-05_b7c62d45df5e06226066bbdd0dcd3092_mafia.exe
-
Size
2.5MB
-
MD5
b7c62d45df5e06226066bbdd0dcd3092
-
SHA1
4a7d2d8abe6bd9ae1e2bb84ad206c6abfb8b884f
-
SHA256
214f3aab13b7cd418dc06e76f83126cd3fdc4cae7faa5329614af6690dbd8f9e
-
SHA512
8cea06e8e0e7894ed5545c45ace2819c4f439c6c9c34acc660d94876f72afbab4f529f26160956745405f3fc88547628242655f55f086bd2b9f0ebee7f2dd640
-
SSDEEP
49152:gLKZiynl92hORTSqrYALc8jeJqpjR3joQBimxIBv145dC3:gLa3nQ0YCOUjRDBikIBdaA3
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-05_b7c62d45df5e06226066bbdd0dcd3092_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-05_b7c62d45df5e06226066bbdd0dcd3092_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-08-05_b7c62d45df5e06226066bbdd0dcd3092_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-05_b7c62d45df5e06226066bbdd0dcd3092_mafia.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
110B
MD5fd04545e80404e029a2b35d35d2604c1
SHA173152e9237fdf1833da5778cac6647d9614ad1ba
SHA256944cf574065ef43c2351aac8d4d3e63846fe81af5890f122ba91a62d134181cd
SHA51207b70b1b0bbcb7da99ff2fb6cda2a14123960c19f564b4ba8dcedbead6827ae9d0645f3d28e6f574d6afa7f5d70590ee55e2c67406261fd80403133d353e7ec8
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
2.1MB
-
Filesize
68KB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
2.1MB
-
Filesize
5.3MB
-
Filesize
2.1MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB