Analysis
-
max time kernel
144s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-10-2024 08:12
General
-
Target
ARBINFOBOT.scr
-
Size
2.7MB
-
MD5
cf7ed26ab265ec92a94327b5db086c50
-
SHA1
0b3ddada345a9855d702d166c5ffd6550ad55a09
-
SHA256
976fd87b32905a84e2de2f2de3ed53999dba3c1451645e9137a57fa92e2582af
-
SHA512
dbf23647193145df52941b2cf4814b113ba38732caf7b90b65b9febea56ea68c7496677c1b21e54ae77f4ee35115b7b614b4f843d49e4e2f405fdcf504933c05
-
SSDEEP
49152:bXz+zBRt59hTkRjttbC2auuHx5oHXpnNj0uWRSS1kJUBCqI:bXz+NRN6tquuHn4XFNouoSS12UQl
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 43 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Control Panel 3 IoCs
-
Modifies registry class 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ARBINFOBOT.scr"C:\Users\Admin\AppData\Local\Temp\ARBINFOBOT.scr" /S1⤵
- Checks computer location settings
- Drops startup file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exe"C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exe"C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c mmm.bat4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\UPDATE.exe"C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\UPDATE.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\UPDATE.exe"C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\UPDATE.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5749812a4fad05c39d16c4c26528905da
SHA1b6139178549afccd0861c2130c16137a72855a19
SHA2561c205f065a7e2b74c573a4d87dbf31ae3125a25bdeb704f249477c46b6480635
SHA51210de9b25a9ed34cebe99da1967cfccb7ce7c229f0e99968924ca8ee5e69a4c26829237fad9e3e4f5f02d62546b137f42281ff50aaf9e29dc70975c34225a06e0
-
Filesize
17B
MD5bf55292f19b02c6dd1934f2ea2c6ae9d
SHA10dc0e99b63b557bd0eef88422a98bdd944bc0d86
SHA2560a233cde4c8f447e9de44205506e62fee592a625f9c4e1ee1394a5de9712902e
SHA512e570ce99327527cd3d63256eac3763ba88e33ff4110bbcbeddce0860e88b45afb8180ef82a01669a6e5205a28353a9fce95a1cd9906da10670f9a7c9d947c500
-
Filesize
3.6MB
MD5833d7a44854f4dc805a801699cab2ceb
SHA18c79119b3a272c724e56e105a47966c1f36ad2f1
SHA256e0938a38290966a19ab178adea743538f9e3e3530f5d2618afcc6a402a91c6d6
SHA51258b6258447487de6ba48c1d2f2d45ba9aab8a52028202a86aa8d31af2184a1e98969ace0b2b35d8c49180a6205786f6eddbd6bf39676889283e300ea0f0383ab
-
Filesize
1KB
MD5c9f1ed52623b4a2db03c9c329bc9f83d
SHA19f07bf8ab8802ab53e34fbf7aba0d9a03e23a2a7
SHA2566accf680e8528d96747df671f570ef14999004509e1ed08b436f38a19c4644ff
SHA51265dd637b24b47de2340cb670370fc34b22278cf290a324dc259864dda33557f24b509f64b582de39fef15030d25c10750b3db56814aa3c22dfc456df34501e6d
-
Filesize
224KB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
3.5MB
-
Filesize
2.0MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
2.0MB
-
Filesize
4.2MB
-
Filesize
2.0MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4.2MB