Overview

overview

10

Static

static

3

2533c55c71...38.exe

windows7-x64

10

2533c55c71...38.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    03-12-2024 00:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2533c55c719d1ad97a05d2355136d6a8cf15eaf36c01dd70450a740291f7a538.exe

  • Size

    3.3MB

  • MD5

    bf82d2c331398018750c202bd9f02e3d

  • SHA1

    495d6af8bd5729e577d83bae342d420a88676ccc

  • SHA256

    2533c55c719d1ad97a05d2355136d6a8cf15eaf36c01dd70450a740291f7a538

  • SHA512

    a05396adf45cf6147271c3568b13e6085e09cff105e476cc272a86bb176bc0be1b328a35fb728e1aeeb0fef2fa93fa3a1947362ed8555bfad2546c4944a84d2c

  • SSDEEP

    98304:RF8QUitE4iLqaPWGnEvSdsc0B18YhT8qM:RFQWEPnPBnEKd50P8YhT81

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (216) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2533c55c719d1ad97a05d2355136d6a8cf15eaf36c01dd70450a740291f7a538.exe
    "C:\Users\Admin\AppData\Local\Temp\2533c55c719d1ad97a05d2355136d6a8cf15eaf36c01dd70450a740291f7a538.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini.tmp
    Filesize

    3.4MB

    MD5

    5cf9cbf6b03e35a8200ead00c192c99c

    SHA1

    76934ffe25acf258478a8fdbe416e0edb66b30e5

    SHA256

    4ace30a83dffb4877fd05735d905daf593fc8384b9ebe84e2e148bf4ee3056cc

    SHA512

    2e012cdac68307d1a23d13741c6c0d04cb369949e6659789d9a07310a273894c00c08342c9a5cf5130863e90db91f329f2f82772b55441b46b9c5d0769f9487b

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    3.4MB

    MD5

    d8c8ffdd57f79c60c44a9d9ee8671996

    SHA1

    1f54a50a7759bca06db5a63e0984918688c6ce51

    SHA256

    69b445434f9f320194c7cd01595dabee0f0cf2cccced728e1bb5bcee6eee7d57

    SHA512

    04b82ae417c3e3eb2d6177b089badfd9ba0afdeac6946a1e2d4757ebbbdf3d3a214255af5a6e51b6eacc19fd5289604393807de121a1c7eaac38e51c3da4e405

    Download Submit

  • memory/956-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/956-1-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/956-8-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/956-11-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/956-13-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/956-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/956-26-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/956-25-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/956-41-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/956-43-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download