Analysis
-
max time kernel
65s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
09-01-2025 00:15
General
-
Target
bfaef2e37334a7f90734e0c2a9e9a515cc57ce6fd64ab9e87355241974f30ba0.exe
-
Size
3.0MB
-
MD5
6419dc2751f212d3989a0131bf04ab1b
-
SHA1
5b9f6db9d843f118ae8ce5ed067f90d6079f358a
-
SHA256
bfaef2e37334a7f90734e0c2a9e9a515cc57ce6fd64ab9e87355241974f30ba0
-
SHA512
8af8611276fe045fd35f4511d7ded67b5d73ea21f2a4647b9306545f41187042feda46f69a7ed30795a901000c1f6714c46bd8f2d2860d9d584274385431bc88
-
SSDEEP
49152:EpbRm4GPK/MI2STfnj2Qb169tOotoVDn99c1/0VXHhf0dWma2sx05tE:Y1GS/32Z3OiuDnu0VXHhBmAxStE
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies registry class 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfaef2e37334a7f90734e0c2a9e9a515cc57ce6fd64ab9e87355241974f30ba0.exe"C:\Users\Admin\AppData\Local\Temp\bfaef2e37334a7f90734e0c2a9e9a515cc57ce6fd64ab9e87355241974f30ba0.exe"1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
4.6MB