Malware Analysis Report

2025-01-22 23:07

Sample ID 241205-cecbjsykdm
Target 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe
SHA256 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad

Threat Level: Known bad

The file 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Renames multiple (200) files with added filename extension

Renames multiple (406) files with added filename extension

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-05 01:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-05 01:58

Reported

2024-12-05 02:01

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

100s

Command Line

"C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A

Renames multiple (406) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwresplm.dat.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\mshwjpn.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\ro.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\sv.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\bg.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\dotnet.exe.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\System\ado\msado60.tlb.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwritalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\ms.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "combase.dll" C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Component Categories Manager" C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe

"C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/5080-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/5080-2-0x00000000049F0000-0x0000000004BFC000-memory.dmp

memory/5080-9-0x00000000049F0000-0x0000000004BFC000-memory.dmp

memory/5080-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/5080-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/5080-14-0x00000000049F0000-0x0000000004BFC000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.tmp

MD5 72b0e2df93bc75db158ab430a8ab03b6
SHA1 211036758ef7cadcf9ec1b6465deff169b5240d0
SHA256 cab0c1c27427cc883ed922c8afb77314e3b07f304d1c5d58aa2d9d10dae3dd00
SHA512 02d5d91c988a9364f524177ff6d048b6c319491469a2ed8983dd55dd04dd285bba05385887b71435bc80bbe63dcba12b503d474fc78c98e82d1489719cce589a

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 1db96b96629e446f7ae101ed3ce317c3
SHA1 7d71fbb0e09bd380a7ff96abd2f37656a1fe4157
SHA256 fecf6b87f0c28e0d745373ea49ebf7c4301d3774449c7e39d3e34e65a39f6364
SHA512 15ecb723df3759ff837cc7b1645323aec49a14cc32d25d76f6cc2d6770af97b853a76f6763bbf93d7a10902630c2054b724c2822f4f98ac5248e634e3d6d4682

memory/5080-45-0x00000000049F0000-0x0000000004BFC000-memory.dmp

memory/5080-44-0x00000000049F0000-0x0000000004BFC000-memory.dmp

memory/5080-116-0x0000000000400000-0x0000000000616000-memory.dmp

memory/5080-134-0x00000000049F0000-0x0000000004BFC000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-05 01:58

Reported

2024-12-05 02:01

Platform

win7-20240903-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A

Renames multiple (200) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\io.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\ast.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\kk.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\vi.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\ms.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\7z.exe.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\ky.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\pl.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\tk.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\ne.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\fur.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\ta.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%systemroot%\\SysWow64\\winrssrv.dll" C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "PSFactoryBuffer" C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe

"C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe"

Network

N/A

Files

memory/2148-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2148-1-0x0000000002FE0000-0x00000000031EC000-memory.dmp

memory/2148-8-0x0000000002FE0000-0x00000000031EC000-memory.dmp

memory/2148-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2148-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2148-13-0x0000000002FE0000-0x00000000031EC000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

MD5 80eec2c199a7413fa1ff5199dd4d1df5
SHA1 fc97da60e5ffcdb88bec475fcaa4157f402c2906
SHA256 b7414efd78fe604a8dbf06ec71edb4fbf2064692068e751bbe6112bcd1d2ff18
SHA512 74d106081c13afc618255667013ab1585b8fc1663446b0f69ab935cc76f7388f15c7d1bd619680290f04c06b03392c3ecab261d23bda5ecd453c7a8d37f632bb

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 e604b89103e85f88a66ad7b28a0da5e7
SHA1 b8474c72610e3c5959cdb8b004df2c764e5176b9
SHA256 23c71c02619fbc99c03f0eb47a31ba9564db0a9e0117fcfbb64f75d8df1175f0
SHA512 a919cd6822e90de5f3dd00a7fef735029ebe0f5a0d04310b8b6d163c6c99adcceccae5ba2841da70edbf2fc70eb961e28160af4076824034361ea41210888416

memory/2148-25-0x0000000002FE0000-0x00000000031EC000-memory.dmp

memory/2148-37-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2148-43-0x0000000002FE0000-0x00000000031EC000-memory.dmp