Overview

overview

10

Static

static

3

f3c7c3cba0...a8.exe

windows7-x64

10

f3c7c3cba0...a8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-12-2024 13:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f3c7c3cba051c85937daa2cad72f59bf6b47b5b9c14cdb42057dbc8fda99e1a8.exe

  • Size

    3.0MB

  • MD5

    299d5f94d35d28ae98e5454a0bdca9a3

  • SHA1

    db7c8111fe03133f118507f4beefcaedc058ae25

  • SHA256

    f3c7c3cba051c85937daa2cad72f59bf6b47b5b9c14cdb42057dbc8fda99e1a8

  • SHA512

    224681a0028f25656dbc6c49feb564000f332da5bab64b65c6e1835698daff1c866b3d9aed3244fa784f91a2734e7aeeda878b7bf3869a2212a56597aba8319f

  • SSDEEP

    49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV47RIgiBul:RF8QUitE4iLqaPWGnEvK7RZ

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (214) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3c7c3cba051c85937daa2cad72f59bf6b47b5b9c14cdb42057dbc8fda99e1a8.exe
    "C:\Users\Admin\AppData\Local\Temp\f3c7c3cba051c85937daa2cad72f59bf6b47b5b9c14cdb42057dbc8fda99e1a8.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp
    Filesize

    3.1MB

    MD5

    aca248dd384f050e935fb0e9cbe477d8

    SHA1

    abd83777609cfe602280bcd699d0bc9a9cd1dedf

    SHA256

    124244b402f7c78a709a3f6a1e9f965ce1542f5b36b65697bcea27e96b92ff46

    SHA512

    3363c8709d3e5ec6b05a5d28d363164339f1c0f31b8ee828f1ea067b60bed1ad7e21e2ca9d39cde0dc403b395e2e02e1a89a3a807c4522b4852fc30a44409fdd

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    3.1MB

    MD5

    1221b775869ca223d729d693ef2c427a

    SHA1

    d7e5939224597d6d474def861620834c2d3a7a01

    SHA256

    cc471550c48abef36d80480e076d6cc991463226892b25e0ed72402d9cc27816

    SHA512

    8eb50e7b23d28db264780080ab7d4549792a64426c38a99eb94ea408a15dfa4305130c09b64a84901f55ac81c33d28ea8090b1a80192a972540df8a82706a670

    Download Submit

  • memory/2084-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2084-1-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2084-8-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2084-11-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2084-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2084-13-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2084-25-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2084-43-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2084-49-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download