Overview

overview

10

Static

static

3

4c69fe8b20...aa.exe

windows7-x64

10

4c69fe8b20...aa.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2024 19:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe

  • Size

    4.6MB

  • MD5

    c0a5f0a0ea95ae5d6b1a3dc36151dfc2

  • SHA1

    b57e795d9f3fe1e61d5f171cda6b411b6d67f21e

  • SHA256

    4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa

  • SHA512

    adc02b226ad781b27bff2bc04c4c6e1121b6bd322673eba22bbf7de76d47af6a0d2c8f2d485cee70337ee84d03a7be0678b0bdabc64f5c7204d0dcc6466a6ead

  • SSDEEP

    98304:RF8QUitE4iLqaPWGnEvSdsc0B18YhT8qX/WqDb:RFQWEPnPBnEKd50P8YhT825b

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (165) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe
    "C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2540

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp
    Filesize

    4.7MB

    MD5

    459cbdf83f42eb26c0233af3c76c66dc

    SHA1

    dac347547671c8ec7543bc1e6a3f255126dd94b2

    SHA256

    46934ec85d7880c8fea191c5db2ae2a893f2474a002989c269f2f4fc2f6c0c8b

    SHA512

    802711b696f8856c2c3e8f65079f8dd1e07e17a387af82de7e40ca06fc4c995940a0e10ffe11c7cfb254005809ef4a60a883cd02477dee76c95250791dce8a99

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    4.8MB

    MD5

    fa7356e32b6d5f2e13461118b91d12b6

    SHA1

    5ad0040eba09221d6296938c8563cb302a5eaaf0

    SHA256

    462efc1dc8669a32060e619eff5bd94ee56ad018bf1cc23ade939555d9b312ba

    SHA512

    a2393218d695f6bd11ab5e220fffefe6aea8c0673414a385d0f15f4309723f5cf28280ba66efce53c6eead436086dd4f3ffc3ea8685107a25efc7ec49b2781d7

    Download Submit

  • memory/2540-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2540-8-0x0000000003040000-0x000000000324C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2540-1-0x0000000003040000-0x000000000324C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2540-13-0x0000000003040000-0x000000000324C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2540-11-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2540-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2540-21-0x0000000003040000-0x000000000324C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2540-27-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2540-29-0x0000000003040000-0x000000000324C000-memory.dmp

    Filesize

    2.0MB

    Download