Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
31-08-2024 23:17
General
-
Target
e7ba3d3528399c31d8f79b1713040a2e8559a6ba25fef26c19b47d07710be9a0.exe
-
Size
2.4MB
-
MD5
c333f1dc22c3e849d3d0fd43eb795ec0
-
SHA1
7bdfcf928ca3d13e34f8d75e06ea392e7e3ac19c
-
SHA256
e7ba3d3528399c31d8f79b1713040a2e8559a6ba25fef26c19b47d07710be9a0
-
SHA512
3f32fe6f4744753f414b69e94f29f895649a8b5d60baf5b0c628c505af7ec78adaff66d608d583431094c05d88ace806de2296843cef3224d187ec525404efbc
-
SSDEEP
49152:pcv0sr0X2TOmnOqTHUo5SzU0q5VWy7EeNetl7hpFo1E1utEjC9WLOwo7:pcvRfOqTHUo5SQPtQA6l7XFo1EAtEjCf
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7ba3d3528399c31d8f79b1713040a2e8559a6ba25fef26c19b47d07710be9a0.exe"C:\Users\Admin\AppData\Local\Temp\e7ba3d3528399c31d8f79b1713040a2e8559a6ba25fef26c19b47d07710be9a0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
3.1MB
-
Filesize
2.0MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
2.0MB