Analysis

  • max time kernel
    96s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 09:50

General

  • Target

    86f5a08e2ff359cd8c64b8ebd5e0b25a22afdf6d17b74bd0aeffff598e876b96N.exe

  • Size

    3.0MB

  • MD5

    241795bf38c027797baf3acc1191d490

  • SHA1

    6bfeda1bca630c32d720d151d8aed891519e1b1b

  • SHA256

    86f5a08e2ff359cd8c64b8ebd5e0b25a22afdf6d17b74bd0aeffff598e876b96

  • SHA512

    a2e462dd6d9e9c3114db5a661405a5ed952705090ebc8d55aeb69e442ff0f3bf776234268e044c20334ebb68e966e806636b56878a0c21abae71df2e9fcdc92c

  • SSDEEP

    49152:vryDFQDfCT3pYSaogHtMyMpy7RYf1TW+dIO8NtAJm2+H24f1zcM6vSsrQO:vryGipaooPWGCfhW+mOmAMRHZ1nssO

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\86f5a08e2ff359cd8c64b8ebd5e0b25a22afdf6d17b74bd0aeffff598e876b96N.exe
    "C:\Users\Admin\AppData\Local\Temp\86f5a08e2ff359cd8c64b8ebd5e0b25a22afdf6d17b74bd0aeffff598e876b96N.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:5112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5112-0-0x0000000000400000-0x00000000008B5000-memory.dmp

    Filesize

    4.7MB

  • memory/5112-2-0x0000000003A00000-0x0000000003C0C000-memory.dmp

    Filesize

    2.0MB

  • memory/5112-9-0x0000000003A00000-0x0000000003C0C000-memory.dmp

    Filesize

    2.0MB

  • memory/5112-13-0x0000000000400000-0x00000000008B5000-memory.dmp

    Filesize

    4.7MB

  • memory/5112-16-0x0000000000400000-0x00000000008B5000-memory.dmp

    Filesize

    4.7MB

  • memory/5112-12-0x0000000000400000-0x00000000008B5000-memory.dmp

    Filesize

    4.7MB

  • memory/5112-15-0x0000000000400000-0x00000000008B5000-memory.dmp

    Filesize

    4.7MB

  • memory/5112-19-0x0000000003A00000-0x0000000003C0C000-memory.dmp

    Filesize

    2.0MB

  • memory/5112-18-0x0000000000400000-0x00000000008B5000-memory.dmp

    Filesize

    4.7MB

  • memory/5112-17-0x0000000000400000-0x00000000008B5000-memory.dmp

    Filesize

    4.7MB

  • memory/5112-20-0x0000000003A00000-0x0000000003C0C000-memory.dmp

    Filesize

    2.0MB

  • memory/5112-22-0x0000000003A00000-0x0000000003C0C000-memory.dmp

    Filesize

    2.0MB

  • memory/5112-25-0x0000000003A00000-0x0000000003C0C000-memory.dmp

    Filesize

    2.0MB

  • memory/5112-24-0x0000000000400000-0x00000000008B5000-memory.dmp

    Filesize

    4.7MB