Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/01/2025, 17:30

General

  • Target

    BIGBOSS.exe

  • Size

    36.6MB

  • MD5

    19773de3aada9bebac1c8a284059e0a5

  • SHA1

    482dcb8326ab158a0b054516cede9d80119dca7b

  • SHA256

    4400ba385c37b8c0ec3c63463794c2a335fe8823a0a43a910ae6400337371217

  • SHA512

    829ee42d011ca1064a272fc626540b5ddf115d1e59e8e107b185def9ced215b96ce3018c7ff4a8a6c30893e313c64e1df58e7771e1d2f868fcfa61c7ecd56346

  • SSDEEP

    786432:w5iyxGxoo4kxSjEN0CgFjaj2G8NkzJD4pSbN+WYbO7fqffK:w01xoLvCgxayG8NkzJDaSbN+WY8qffK

Malware Config

Signatures

  • AxBanker

    AxBanker is an Android banking trojan that targets bank customers information distributed through fake bank applications.

  • Axbanker family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 27 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BIGBOSS.exe
    "C:\Users\Admin\AppData\Local\Temp\BIGBOSS.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --start-in-incognito
      2⤵
        PID:3824
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\host\jGAkSn\jGAkSnQI.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Network\host\\jGAkSn\jGAkSnQI.exe" MAIN_EXE
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3292
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --start-in-incognito
          3⤵
            PID:1540
          • C:\Windows\SysWOW64\netsh.exe
            "netsh" int tcp set heuristics disabled
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3908
          • C:\Windows\SysWOW64\netsh.exe
            "netsh" int tcp set global autotuninglevel=normal
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3940
          • C:\Windows\SysWOW64\netsh.exe
            "netsh" int tcp set global congestionprovider=ctcp
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3628
          • C:\Windows\SysWOW64\netsh.exe
            "netsh" int tcp set global ecncapability=default
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3548
          • C:\Windows\SysWOW64\netsh.exe
            "netsh" int tcp set global rss=enabled
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2836
          • C:\Windows\SysWOW64\netsh.exe
            "netsh" int tcp set global chimney=disabled
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:1036
          • C:\Windows\SysWOW64\netsh.exe
            "netsh" int tcp set global dca=enabled
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4464
          • C:\Windows\SysWOW64\netsh.exe
            "netsh" int tcp set global timestamps=disabled
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            • System Time Discovery
            PID:3764
          • C:\Windows\SysWOW64\netsh.exe
            "netsh" int tcp set global rsc=enabled
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:1208

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\host\jGAkSn\jGAkSnQI.exe

        Filesize

        23.4MB

        MD5

        dc7c215937c74c3d504e8d62ac02eefe

        SHA1

        c8cf580bab370b96880d2963370f49e56a3d21ac

        SHA256

        ea69aac13ded5004e33dd2cba9c8b2f5a646c752015f9f0842c35ff004423ddb

        SHA512

        7c1ea96ece4f449f71f24e065c813bb3c65833445573c3976562dfd00959b0ace5d8ebadd76efcfbbddc68578c69ca3640e883a94f24edb3fed5a5402e989b04

      • memory/2412-0-0x0000000000EA0000-0x00000000043A2000-memory.dmp

        Filesize

        53.0MB

      • memory/2412-6-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-5-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-4-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-3-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-2-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-1-0x00000000756F0000-0x00000000756F1000-memory.dmp

        Filesize

        4KB

      • memory/2412-7-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-8-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-12-0x0000000000EA0000-0x00000000043A2000-memory.dmp

        Filesize

        53.0MB

      • memory/2412-13-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-14-0x0000000000EA0000-0x00000000043A2000-memory.dmp

        Filesize

        53.0MB

      • memory/2412-15-0x0000000000EA0000-0x00000000043A2000-memory.dmp

        Filesize

        53.0MB

      • memory/2412-19-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-18-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-17-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-16-0x00000000756F0000-0x00000000756F1000-memory.dmp

        Filesize

        4KB

      • memory/2412-20-0x0000000008DD0000-0x0000000009374000-memory.dmp

        Filesize

        5.6MB

      • memory/2412-21-0x00000000062A0000-0x0000000006332000-memory.dmp

        Filesize

        584KB

      • memory/2412-22-0x0000000008BC0000-0x0000000008BCA000-memory.dmp

        Filesize

        40KB

      • memory/2412-23-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-25-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-26-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-31-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/2412-37-0x0000000000EA0000-0x00000000043A2000-memory.dmp

        Filesize

        53.0MB

      • memory/2412-38-0x00000000756D0000-0x00000000757C0000-memory.dmp

        Filesize

        960KB

      • memory/3292-39-0x0000000000760000-0x0000000004438000-memory.dmp

        Filesize

        60.8MB

      • memory/3292-40-0x0000000000760000-0x0000000004438000-memory.dmp

        Filesize

        60.8MB

      • memory/3292-41-0x0000000007430000-0x000000000743A000-memory.dmp

        Filesize

        40KB

      • memory/3292-42-0x0000000009850000-0x00000000098F0000-memory.dmp

        Filesize

        640KB

      • memory/3292-44-0x0000000009910000-0x000000000995A000-memory.dmp

        Filesize

        296KB

      • memory/3292-45-0x0000000009960000-0x0000000009A1C000-memory.dmp

        Filesize

        752KB

      • memory/3292-43-0x00000000098F0000-0x0000000009916000-memory.dmp

        Filesize

        152KB

      • memory/3292-46-0x0000000009A30000-0x0000000009B62000-memory.dmp

        Filesize

        1.2MB

      • memory/3292-47-0x000000000A1B0000-0x000000000A47C000-memory.dmp

        Filesize

        2.8MB

      • memory/3292-48-0x0000000009BB0000-0x0000000009BB8000-memory.dmp

        Filesize

        32KB

      • memory/3292-50-0x000000000A480000-0x000000000A4F6000-memory.dmp

        Filesize

        472KB

      • memory/3292-49-0x0000000009BC0000-0x0000000009BD2000-memory.dmp

        Filesize

        72KB

      • memory/3292-51-0x0000000009BD0000-0x0000000009BF6000-memory.dmp

        Filesize

        152KB

      • memory/3292-53-0x000000000A520000-0x000000000A544000-memory.dmp

        Filesize

        144KB

      • memory/3292-52-0x000000000A4F0000-0x000000000A51A000-memory.dmp

        Filesize

        168KB

      • memory/3292-55-0x000000000A550000-0x000000000AAFA000-memory.dmp

        Filesize

        5.7MB

      • memory/3292-62-0x000000000AFF0000-0x000000000B000000-memory.dmp

        Filesize

        64KB

      • memory/3292-61-0x000000000AFD0000-0x000000000AFF6000-memory.dmp

        Filesize

        152KB

      • memory/3292-60-0x000000000AF60000-0x000000000AFB8000-memory.dmp

        Filesize

        352KB

      • memory/3292-59-0x000000000AF40000-0x000000000AF5C000-memory.dmp

        Filesize

        112KB

      • memory/3292-58-0x000000000AEE0000-0x000000000AF44000-memory.dmp

        Filesize

        400KB

      • memory/3292-57-0x000000000ADE0000-0x000000000AECE000-memory.dmp

        Filesize

        952KB

      • memory/3292-56-0x000000000AC40000-0x000000000ADCC000-memory.dmp

        Filesize

        1.5MB

      • memory/3292-64-0x000000000B0D0000-0x000000000B0D8000-memory.dmp

        Filesize

        32KB

      • memory/3292-63-0x000000000B000000-0x000000000B0A8000-memory.dmp

        Filesize

        672KB

      • memory/3292-65-0x000000000B0E0000-0x000000000B0E8000-memory.dmp

        Filesize

        32KB

      • memory/3292-67-0x000000000B130000-0x000000000B146000-memory.dmp

        Filesize

        88KB

      • memory/3292-66-0x000000000B0F0000-0x000000000B122000-memory.dmp

        Filesize

        200KB

      • memory/3292-68-0x000000000B150000-0x000000000B1C2000-memory.dmp

        Filesize

        456KB

      • memory/3292-69-0x000000000D580000-0x000000000DD26000-memory.dmp

        Filesize

        7.6MB