Overview

overview

10

Static

static

3

867a698567...1d.exe

windows7-x64

10

867a698567...1d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2024 01:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    867a698567e61aea24aeff1767619b9494a5dfcf8fd63c7282c29c42c8dfac1d.exe

  • Size

    3.3MB

  • MD5

    fc8c310f416f252bd419dc55cc08e7a9

  • SHA1

    37c58bd11af4de0b0c2aa744b142cc38660bfd4f

  • SHA256

    867a698567e61aea24aeff1767619b9494a5dfcf8fd63c7282c29c42c8dfac1d

  • SHA512

    bb45a141c53f9917473a691ae3889fe7ce06d96682ff33eced5d20b1e8972fde75cbb26ea9e4ca799211c0cd2b5e8a3a9977a200796a5c285d0fcb0d71e5491c

  • SSDEEP

    98304:AXz+HqdYDMjxN3b8/rfb6ray6lwhKW8NArojH:oKHqCm8/n6WWhKdA8j

Score
10/10
banloadcredential_accessdiscoverydownloaderdropperpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 43 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 3 IoCs
    evasion
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\867a698567e61aea24aeff1767619b9494a5dfcf8fd63c7282c29c42c8dfac1d.exe
    "C:\Users\Admin\AppData\Local\Temp\867a698567e61aea24aeff1767619b9494a5dfcf8fd63c7282c29c42c8dfac1d.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5084
    • C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\svchost.exe
      "C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\svchost.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3584
      • C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\svchost.exe
        "C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\svchost.exe"
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\svchost.exe
          "C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\svchost.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Sets desktop wallpaper using registry
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies Control Panel
          • Suspicious use of WriteProcessMemory
          PID:4180
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c mmm.bat
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4332
    • C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\update_kor.exe
      "C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\update_kor.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1568
      • C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\update_kor.exe
        "C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\update_kor.exe"
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2432
        • C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\update_kor.exe
          "C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\update_kor.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:4408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\mmm.bat
    Filesize

    17B

    MD5

    bf55292f19b02c6dd1934f2ea2c6ae9d

    SHA1

    0dc0e99b63b557bd0eef88422a98bdd944bc0d86

    SHA256

    0a233cde4c8f447e9de44205506e62fee592a625f9c4e1ee1394a5de9712902e

    SHA512

    e570ce99327527cd3d63256eac3763ba88e33ff4110bbcbeddce0860e88b45afb8180ef82a01669a6e5205a28353a9fce95a1cd9906da10670f9a7c9d947c500

    Download Submit

  • C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\svchost.exe
    Filesize

    3.6MB

    MD5

    a4d579242cbf6c4761124161bf9e1444

    SHA1

    6f6c25411ee73052b7e37dc7cbd3d2bdf7de0552

    SHA256

    07167fead787919772459efaf1a560c683dfa674ed6f8b1b4f7cf980ffdeeda0

    SHA512

    1d6bffda5074c570a846893d61e42d0920b0bd79ae071bb1471df44d21c2ab30f2e9efbbc197ea84e3441a4ed58f541d2ca1c171bb5d94bbf1e15cb52e296e8f

    Download Submit

  • C:\Program Files (x86)\Ñóäåáíûå Ïðèñòàâû ÐÔ\èíôîðìàöèîííûé áþëëåòåíü\update_kor.exe
    Filesize

    3.0MB

    MD5

    8fd9f85c03159c229734734c1c60277c

    SHA1

    db142eed904c4a9f7d689dc7c128f35c14dfe50b

    SHA256

    aedb77172cc2a283957bf992b75f26cfe747d274edae7ad2d62dda841cf7cdef

    SHA512

    0d0006d1b146db6ed3a320ef73eece5d477bff4a7d5f022f59c456d617fe485650ad6e51c4fd8e896d46a23dc9c2679b958e8d47d8ddcabddeae91abc47442f6

    Download Submit

  • C:\ProgramData\TEMP\RAIDTest
    Filesize

    4B

    MD5

    c2f09542b6c7daf4288f3524c8cebb18

    SHA1

    9430b21baf07f0d105b9ee5fdd9f868418454517

    SHA256

    55d7808233c58f1606fff77eb382a02ed729bf5d8b2640fb313d0f7c91e970d4

    SHA512

    dcc19cfbc78b78708ce2586228424194f846d80b6d072045baaf93559d20f71e809a4eb57e7dac3b4ea109d90aeb585d0b5438dc1dd7d34054c03aa6350d6672

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\NO_PWDS_report_08-11-2024_01-08-37-A3C533590EF2311EE9B53A58957F0C8A-FKFK.bin
    Filesize

    1KB

    MD5

    aa199e2ba6bedefc8487da49cbda4af2

    SHA1

    038ba10ddd6b2f88dc48485cd19d2f1ea7492dbe

    SHA256

    f828bc8b17d6f85c0ceef6858a9867d5408057d379d3a97ade6ccb01dee2fe34

    SHA512

    7861b26497e47d7cc2a8c77f2dd2aa4379f835ccf3224086a414a5d0116636c8460476b93914b7a122a990071ab813baae41e5ab7930b868be47f38f0602c230

    Download Submit

  • memory/1568-41-0x0000000000400000-0x0000000000738000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/1568-84-0x0000000000400000-0x0000000000738000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/1568-67-0x0000000000400000-0x0000000000738000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/2432-86-0x0000000000400000-0x0000000000738000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/2432-72-0x0000000000400000-0x0000000000738000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/2432-53-0x0000000002B10000-0x0000000002D14000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2432-47-0x0000000000400000-0x0000000000738000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/2432-64-0x0000000000400000-0x0000000000738000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/2432-63-0x0000000000400000-0x0000000000738000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/2432-65-0x0000000002B10000-0x0000000002D14000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2432-82-0x0000000002B10000-0x0000000002D14000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2432-57-0x0000000002B10000-0x0000000002D14000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2432-68-0x0000000002B10000-0x0000000002D14000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2740-76-0x0000000003000000-0x0000000003204000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2740-48-0x0000000003000000-0x0000000003204000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2740-73-0x0000000000400000-0x00000000007CA000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2740-75-0x0000000003000000-0x0000000003204000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2740-74-0x0000000000400000-0x00000000007CA000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2740-52-0x0000000003000000-0x0000000003204000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2740-104-0x0000000000400000-0x00000000007CA000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2740-44-0x0000000000400000-0x00000000007CA000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2740-101-0x0000000003000000-0x0000000003204000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2740-70-0x0000000000400000-0x00000000007CA000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/3584-102-0x0000000000400000-0x00000000007CA000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/3584-66-0x0000000000400000-0x00000000007CA000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/3584-36-0x0000000000400000-0x00000000007CA000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/4180-106-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

    Download

  • memory/4180-107-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

    Download

  • memory/4180-863-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

    Download

  • memory/4408-98-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

    Download

  • memory/4408-83-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

    Download

  • memory/5084-40-0x0000000000400000-0x000000000044D000-memory.dmp

    Filesize

    308KB

    Download