Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/03/2025, 00:42
General
-
Target
962208665e0733cb65acc4192a86befd1653b30c0302dc6b09be0ba08ba52515.exe
-
Size
2.2MB
-
MD5
975f3da1ab93ab0d6c40de6fff573a32
-
SHA1
aeeb10b081796a3b4f54e205ae6fc6615a947d68
-
SHA256
962208665e0733cb65acc4192a86befd1653b30c0302dc6b09be0ba08ba52515
-
SHA512
862bb544e1a9746b1aac8e00d14a6989e63278607ac43f0d27cbab8cda255b13bb5e03ccf4eac26a9ddc18eb0b68b3c331b772826770dd1e70e608767028666f
-
SSDEEP
49152:j2gYP6qkyHWWTEk4gov+M7+68B1ECYJgkCm+:j2fP6DyOkBov+Mq68B+5J41
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\962208665e0733cb65acc4192a86befd1653b30c0302dc6b09be0ba08ba52515.exe"C:\Users\Admin\AppData\Local\Temp\962208665e0733cb65acc4192a86befd1653b30c0302dc6b09be0ba08ba52515.exe"1⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.8MB