Overview

overview

10

Static

static

3

df71f6a029...9c.exe

windows7-x64

10

df71f6a029...9c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07-12-2024 08:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe

  • Size

    4.8MB

  • MD5

    e991437b9e887945bbb81eaedf64ed52

  • SHA1

    f3da647360636af64be5bba43a569bf354649759

  • SHA256

    df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c

  • SHA512

    f61cc3ecaa4bc85dd96cbde04e50a97fd26ced45d4ddf101fe9b119988b86a09a56d644146f7d87cf427f25c4c4d98e9711292602fdd8aa45bfc01b97c0c4edd

  • SSDEEP

    98304:RF8QUitE4iLqaPWGnEvK7RkOEEo+A7mOk3oaCVA7m2l:RFQWEPnPBnEXE

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (198) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe
    "C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2280

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp
    Filesize

    4.9MB

    MD5

    20cae2ed4cd1121a26a77c67977ace0b

    SHA1

    4444b316ad0cd3cfe96b38c8227b04f18e4f68b1

    SHA256

    291767ad1931d054bcf1babceddc46632d2ed0caee7239664edd1c568959ee26

    SHA512

    cacd5f104a43e0f6e1a087eb3a17f5bd107afc2f36a04f3cd95461afaef95dbcd9ed56363a9eac4069a257557c1f5cb917af7e4d3ebed7aadd810ec05fdca744

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    4.9MB

    MD5

    7ceec98b7c39a3f4684e5ef7ebe08759

    SHA1

    300b7f5aed518cb570b28dad4269137a465e9c46

    SHA256

    8a50a1f208dabda632b36984bf5d5499a512cb09c86e9d3f7ea5f57b15436018

    SHA512

    5e0b616d611a6f40d87c1bfd50425cff460c17b7297cbf31070f45c5e5845662eb9bfb4b82b6d7ad856ff67031d6a6d795980c58ef311272a3f520ed0bfbb2f4

    Download Submit

  • memory/2280-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2280-1-0x0000000002F80000-0x000000000318C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2280-8-0x0000000002F80000-0x000000000318C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2280-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2280-11-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2280-13-0x0000000002F80000-0x000000000318C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2280-26-0x0000000002F80000-0x000000000318C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2280-25-0x0000000002F80000-0x000000000318C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2280-39-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2280-43-0x0000000002F80000-0x000000000318C000-memory.dmp

    Filesize

    2.0MB

    Download