Malware Analysis Report

2025-01-22 23:11

Sample ID 241127-ylbt9atpcn
Target 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe
SHA256 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa

Threat Level: Known bad

The file 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Renames multiple (196) files with added filename extension

Renames multiple (299) files with added filename extension

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-27 19:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-27 19:51

Reported

2024-11-27 19:54

Platform

win7-20240903-en

Max time kernel

120s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A

Renames multiple (196) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\7z.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\uz.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\nb.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\ta.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\vi.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\bg.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\eu.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\License.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\ar.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\mn.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Uninstall.exe.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\sw.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\kk.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Task Management Module" C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Verb C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Verb\0 C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Verb\0\ = "&Edit,0,2" C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Verb\1 C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Verb\1\ = "&Open,0,2" C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe

"C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe"

Network

N/A

Files

memory/2508-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2508-8-0x00000000032C0000-0x00000000034CC000-memory.dmp

memory/2508-1-0x00000000032C0000-0x00000000034CC000-memory.dmp

memory/2508-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2508-13-0x00000000032C0000-0x00000000034CC000-memory.dmp

memory/2508-12-0x0000000000400000-0x0000000000616000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

MD5 1675a5fd76721edc864694bad70f716f
SHA1 28bfc27c269c7829016ecf7f5945c2fdb33ee15c
SHA256 c8f7d99b45ef8743ebc8585ccd797e96ef7049907df60cdd1b740f4625d13e1d
SHA512 2b5726f7740f35a621870a552cd8ed4e571665ceecd114bded9e8feac1f82b84cce0cfbbce7839d9e7d270cbf29be802c6085321e7a7461dd872de5d3a7c5815

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 d2b61ef7a6ae42f08aa2517d8549aebf
SHA1 79bbc1ff48faf47c3035d81ae83629ce7abf593f
SHA256 04aff2439414aba6a70bc2c4e6ae720764ba3a6a5375db8f395373fd63eef2ee
SHA512 1e3e419715fb45c035eda0a5ac5f486a4b5f1acaa5c637f1c256aa0d03d01c2745e3a35c210b0c3d04351df3d3c6368a15d845d804deee674617879538a74559

memory/2508-25-0x00000000032C0000-0x00000000034CC000-memory.dmp

memory/2508-37-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2508-43-0x00000000032C0000-0x00000000034CC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-27 19:51

Reported

2024-11-27 19:54

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A

Renames multiple (299) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\yo.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\kab.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Crashpad\settings.dat.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\eo.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\ka.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Help Collection Wrapper Class" C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%SystemRoot%\\SysWow64\\mmcshext.dll" C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe

"C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 68.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp

Files

memory/2816-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2816-2-0x0000000004990000-0x0000000004B9C000-memory.dmp

memory/2816-9-0x0000000004990000-0x0000000004B9C000-memory.dmp

memory/2816-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2816-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2816-14-0x0000000004990000-0x0000000004B9C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1045960512-3948844814-3059691613-1000\desktop.ini.tmp

MD5 2ff3e182d1fce3ceab9bab630505cef2
SHA1 971c9a4b72c7fd3ae3532c42054359a57789ad1f
SHA256 0a96dbffc91214688255e2661bdd9e185ffbf559604f6e45af85150f5d1b3f80
SHA512 3490eaf61a101d1ff5a5ec730b42b5b73f09ff3c372347aac7c14277485dfd11562dcb1e641da3fa6c771352c3330583b771f0e91bc7f86d933c5364840ea1d3

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 c789387fce9f7bb43e5a50aa3fd71a28
SHA1 cabac65d0455f214a2bf6d918482690f8a4eb58b
SHA256 89733c65619d931d7400710999842efbfa0bc28858404ed3fbff5f44c3009648
SHA512 8f98f0212f9d3a337b073ae618deb90c547baacd76319055baa86e53540aede1b10272a8e03b829c879edbd576f9d9cdeb445ee3784549af9af7c3d4d0929a64

memory/2816-37-0x0000000004990000-0x0000000004B9C000-memory.dmp

memory/2816-36-0x0000000004990000-0x0000000004B9C000-memory.dmp

memory/2816-96-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2816-110-0x0000000004990000-0x0000000004B9C000-memory.dmp