Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-10-2024 08:12
General
-
Target
ARBINFOBOT.scr
-
Size
2.7MB
-
MD5
cf7ed26ab265ec92a94327b5db086c50
-
SHA1
0b3ddada345a9855d702d166c5ffd6550ad55a09
-
SHA256
976fd87b32905a84e2de2f2de3ed53999dba3c1451645e9137a57fa92e2582af
-
SHA512
dbf23647193145df52941b2cf4814b113ba38732caf7b90b65b9febea56ea68c7496677c1b21e54ae77f4ee35115b7b614b4f843d49e4e2f405fdcf504933c05
-
SSDEEP
49152:bXz+zBRt59hTkRjttbC2auuHx5oHXpnNj0uWRSS1kJUBCqI:bXz+NRN6tquuHn4XFNouoSS12UQl
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 4 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 64 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Control Panel 3 IoCs
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ARBINFOBOT.scr"C:\Users\Admin\AppData\Local\Temp\ARBINFOBOT.scr" /S1⤵
- Drops startup file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exe"C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exe"C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c mmm.bat4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\UPDATE.exe"C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\UPDATE.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\UPDATE.exe"C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\UPDATE.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5749812a4fad05c39d16c4c26528905da
SHA1b6139178549afccd0861c2130c16137a72855a19
SHA2561c205f065a7e2b74c573a4d87dbf31ae3125a25bdeb704f249477c46b6480635
SHA51210de9b25a9ed34cebe99da1967cfccb7ce7c229f0e99968924ca8ee5e69a4c26829237fad9e3e4f5f02d62546b137f42281ff50aaf9e29dc70975c34225a06e0
-
Filesize
17B
MD5bf55292f19b02c6dd1934f2ea2c6ae9d
SHA10dc0e99b63b557bd0eef88422a98bdd944bc0d86
SHA2560a233cde4c8f447e9de44205506e62fee592a625f9c4e1ee1394a5de9712902e
SHA512e570ce99327527cd3d63256eac3763ba88e33ff4110bbcbeddce0860e88b45afb8180ef82a01669a6e5205a28353a9fce95a1cd9906da10670f9a7c9d947c500
-
Filesize
3.6MB
MD5833d7a44854f4dc805a801699cab2ceb
SHA18c79119b3a272c724e56e105a47966c1f36ad2f1
SHA256e0938a38290966a19ab178adea743538f9e3e3530f5d2618afcc6a402a91c6d6
SHA51258b6258447487de6ba48c1d2f2d45ba9aab8a52028202a86aa8d31af2184a1e98969ace0b2b35d8c49180a6205786f6eddbd6bf39676889283e300ea0f0383ab
-
Filesize
1KB
MD587b04024d1d0c19b5c35dcafdedeb8e2
SHA1b6679774cdbdd676713ad7c1f7a747776008e926
SHA256c6c2ac19e276123b59b8f1c695a7c08a915ac939e913c1c2dd95ed73d1803b79
SHA51228159f985b05ce5697498af6b9af75a3cdb93da268dc425d09e93592f26850aebc0049f420e677b6a358ef91c9c9a6e8c9187e6fa633667c9355a435e201c423
-
Filesize
4B
MD5c2f09542b6c7daf4288f3524c8cebb18
SHA19430b21baf07f0d105b9ee5fdd9f868418454517
SHA25655d7808233c58f1606fff77eb382a02ed729bf5d8b2640fb313d0f7c91e970d4
SHA512dcc19cfbc78b78708ce2586228424194f846d80b6d072045baaf93559d20f71e809a4eb57e7dac3b4ea109d90aeb585d0b5438dc1dd7d34054c03aa6350d6672
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
2.0MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
3.5MB
-
Filesize
2.0MB
-
Filesize
3.5MB
-
Filesize
2.0MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
224KB
-
Filesize
4.2MB
-
Filesize
3.5MB