Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 10:41
General
-
Target
193fe6fe03594e96b3dc3c998e6f717a28149f038e02ce8d2a12c8c54c13f343.exe
-
Size
2.1MB
-
MD5
5b42d7290c30242ba84510440d7998e3
-
SHA1
5ac4e2f7dd26b78d4ab197e475ad483ab67b8422
-
SHA256
193fe6fe03594e96b3dc3c998e6f717a28149f038e02ce8d2a12c8c54c13f343
-
SHA512
ae09e170d7089aa516a723c221f058318ac8950bc7439d74da272fb61a44cf268ffcbc87ee41a44a49fba7eef506e308d32e89bf4e4ab64148955023a7450a39
-
SSDEEP
49152:fpbRm4GPK/Mh2mTsGKgQApfseq+5oVDn99c1/0VXBMg/yxA+:B1GS/1grFqouDnu0VXV/yx7
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies registry class 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\193fe6fe03594e96b3dc3c998e6f717a28149f038e02ce8d2a12c8c54c13f343.exe"C:\Users\Admin\AppData\Local\Temp\193fe6fe03594e96b3dc3c998e6f717a28149f038e02ce8d2a12c8c54c13f343.exe"1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
2.7MB