Overview

overview

10

Static

static

3

2533c55c71...38.exe

windows7-x64

10

2533c55c71...38.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-12-2024 00:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2533c55c719d1ad97a05d2355136d6a8cf15eaf36c01dd70450a740291f7a538.exe

  • Size

    3.3MB

  • MD5

    bf82d2c331398018750c202bd9f02e3d

  • SHA1

    495d6af8bd5729e577d83bae342d420a88676ccc

  • SHA256

    2533c55c719d1ad97a05d2355136d6a8cf15eaf36c01dd70450a740291f7a538

  • SHA512

    a05396adf45cf6147271c3568b13e6085e09cff105e476cc272a86bb176bc0be1b328a35fb728e1aeeb0fef2fa93fa3a1947362ed8555bfad2546c4944a84d2c

  • SSDEEP

    98304:RF8QUitE4iLqaPWGnEvSdsc0B18YhT8qM:RFQWEPnPBnEKd50P8YhT81

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (230) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2533c55c719d1ad97a05d2355136d6a8cf15eaf36c01dd70450a740291f7a538.exe
    "C:\Users\Admin\AppData\Local\Temp\2533c55c719d1ad97a05d2355136d6a8cf15eaf36c01dd70450a740291f7a538.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp
    Filesize

    3.4MB

    MD5

    2207c566d628772ffa227b12058ac327

    SHA1

    acd368b80b09c5eab08b48b5208b5de9fef55c39

    SHA256

    5564d3ac8d4ae9d0c266bc4c60eefd0f6c248bff0251a25546afe22aa00a14de

    SHA512

    e46b920b76fbac2200c5f10c8a19508dbc98e9323cfdb81fd8def4203a242a71f11815996f33c59acbee4ebaf77dd9fe0080f52cd4a1ba429aaae787286564ff

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    3.4MB

    MD5

    c5b414a21d5a8460aa82a0bd43b2752e

    SHA1

    00026fb7c047d83468ae828243dfaf4645d035b8

    SHA256

    a695aafb7ab4b09c211a3acb27c2b8ceeab3db3fcf5d725bf421d0c5eb7b6cd6

    SHA512

    cff55c7881267cd1c685dc4eef61deb5522da4a08dd7bb230b82f650b629e202e64049d7bca1302616f8eb7ca24f6c8113507ea1b73df5d9928d1ad8d8f785d2

    Download Submit

  • memory/2288-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2288-8-0x0000000003100000-0x000000000330C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2288-1-0x0000000003100000-0x000000000330C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2288-11-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2288-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2288-13-0x0000000003100000-0x000000000330C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2288-25-0x0000000003100000-0x000000000330C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2288-43-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2288-53-0x0000000003100000-0x000000000330C000-memory.dmp

    Filesize

    2.0MB

    Download