Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-12-2024 16:17
General
-
Target
CI3.exe
-
Size
2.4MB
-
MD5
7fc7d17fe99e96b403224b6d0363f6e8
-
SHA1
a892e59ccb3b95ad8e50ab8bcfa9925b92c219fe
-
SHA256
15c5e0826a4ec78ae00ccff64a3a63e365a6dfb2cd3efa87608e88ab45ec19cb
-
SHA512
9c3cfdbb3b93b61d9d38e65c9a1ab1da5bcbe6f428a6eebae53ea70fa1076c5996e9085a231cabe5c5cc1ca366880901f9c1f15a8cb8fcdc5f811f49323ffe8c
-
SSDEEP
49152:unEwQWnvUTHKW6NUUOnfPd5wydwdqWiK+l4/qB:unEAkKW6CUAfPSdZiK5/Q
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 17 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CI3.exe"C:\Users\Admin\AppData\Local\Temp\CI3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2e0 0x4ac1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
871B
MD5888ef788e9638027cdb6eeb0332067d8
SHA141b6955f86dd527ab09ec481281e43247b9e52c6
SHA2560d2888b864984e6f414451f7fdeb3c287d4584e8b1cdf62d4ca823c283f65eca
SHA5122b1d9b9c2e5831cd6d16dae7c4c8ea763984bb63d9573fe2bd71f9ad5d54e510be88a4de976d8890c26a8282c6af794a1b3e9bc0af0fedcd9f89d7e1e3c91371
-
Filesize
871B
MD5a31293afbcdaec4c6ddb6cab0d2b1aef
SHA15bf1c5f871dc7f1e8c84b97c1ea331218ff12fa1
SHA25611b7ae28b7939eef8b7354f3a4724cbc83f08ef5ac9eb08f6e5db44af9f30172
SHA512c7696ccb719b4f0362976a97d971cbdbb053c753143ec70756d47d7dc3c69cc83e1fd90057244901add001b6fb31d3002472621dd2edb70d93276f0f70007ec8
-
Filesize
691B
MD5fd13f67c6b6182fcc139c22ea2e5533d
SHA1ec7e15a544cb1b925e315f6c37e32f205738e58b
SHA2568a94cc1f4400f4c67e76759fec9045721f919613ccaa3831e2668a3c5992dad5
SHA512192df534c9a28fbef4c8885b7fab420bf20e058b82a5369db085b28b6644d3e56b7e90b3fcb18e99e380950fb7f88c1088080f86a960d57a4bf7f0b83fa77bcd
-
Filesize
841B
MD57578973bd9ff088c211d5014b730a16c
SHA1d9ba76c07fdf1f6452ea86b3a748d65e4bccb21a
SHA256c7ec425954cffb9fa8bd71861b67eb051a662ce4d504a64683499c4f9d99874c
SHA5120300874244c7defac70d09208daebdd0bf0c24eda6ce29e581a38d0caa0dc0a8006d06cd51f6e69b40d845672dc34bd5d4d30911a3e08daabc12ae0987963f06
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
2.0MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
256KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4.3MB
-
Filesize
256KB
-
Filesize
4.3MB
-
Filesize
256KB
-
Filesize
4.3MB
-
Filesize
256KB
-
Filesize
4.3MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
256KB
-
Filesize
4.3MB
-
Filesize
256KB
-
Filesize
4.3MB
-
Filesize
256KB
-
Filesize
4.3MB
-
Filesize
256KB
-
Filesize
4.3MB
-
Filesize
256KB
-
Filesize
4.3MB
-
Filesize
256KB
-
Filesize
4.3MB
-
Filesize
256KB
-
Filesize
4.3MB
-
Filesize
256KB
-
Filesize
4.3MB
-
Filesize
256KB
-
Filesize
4.3MB