Analysis
-
max time kernel
104s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
-
submitted
26/03/2025, 06:47
General
-
Target
2025-03-26_58b805e02139620394a84c560ea7d9a8_mafia.exe
-
Size
2.0MB
-
MD5
58b805e02139620394a84c560ea7d9a8
-
SHA1
9f115f23d1e90d7f17da4a84f0618ee2b0204bbe
-
SHA256
a12379b66f38a4ac63e45b5aecb09b2938c9c0b23f26de180855ed09c4503875
-
SHA512
5b571120a1072c81952ecc03d1bf37c4029c22c3cf4530d9b4b78a76d2ad1ee928266bf0787ac6ee28eb8e3b80ce963d3a3c7b4edd08c406ba469227e5137855
-
SSDEEP
24576:83fNivy3GG/ZuO0Tw0nWTcno0N1/jaij/oTMfAVT2PzQ5hDWZLuGDvBW/md/vDsQ:0f3GG/h0nWTmfTgTVKbOhDYLxVp9nR
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-26_58b805e02139620394a84c560ea7d9a8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-26_58b805e02139620394a84c560ea7d9a8_mafia.exe"1⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB