Analysis
-
max time kernel
60s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-12-2024 19:26
General
-
Target
8b1366a7c04bd00cb75d51c4d944005b7c63eb985f9d9a94f83bcc6494b25c96.exe
-
Size
6.2MB
-
MD5
04b19b217d78181c8951c1a097cee7aa
-
SHA1
b4839f938fb95e3ab97bf1872efdf0018ed4a7e3
-
SHA256
8b1366a7c04bd00cb75d51c4d944005b7c63eb985f9d9a94f83bcc6494b25c96
-
SHA512
aa2b710d1993b6f50e76ec5af5573592870d8f7caf4d338bf8797c6dc134436693d23d305e2b60a5863e66f2e2b858fa7503b996e427785e4b14958571cf83c8
-
SSDEEP
98304:RF8QUitE4iLqaPWGnEv7/IJsiC5sop7cTe:RFQWEPnPBnEQsiC592Te
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Renames multiple (124) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Drops file in Program Files directory 41 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b1366a7c04bd00cb75d51c4d944005b7c63eb985f9d9a94f83bcc6494b25c96.exe"C:\Users\Admin\AppData\Local\Temp\8b1366a7c04bd00cb75d51c4d944005b7c63eb985f9d9a94f83bcc6494b25c96.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.3MB
MD58923e5dfa1dd2303e3bece9da71757e7
SHA110d2c8b745e76177513e9b5594f0f59ba3bd8429
SHA256677a4a293ad27cfa3ae5318bd90437c2e08eb50afb4c4c1b2c0a493c73e121a9
SHA512b02b16c679191f350648cf93fb6b18fdde277d495e1eb01996ef5fd9ff43f44c3ff7f6860438d1ce509408e02180325fbf7313c4ad732eda7d3d2b24d9b70b01
-
Filesize
6.3MB
MD537b19ae6bad2f076fda620815a058d6a
SHA1978f450517abf45eb2db3a5ee4e352c1cc431a17
SHA2563745172b6d084b1c17d3a3d7b279f550881b8ef6dc436c5edeb44b4ba6ef58af
SHA512ab84e421b9c99980a1e85b92989f48e21159ae206dd12196320c198d913cf1c009d94464b4dedf9f85de8acf8ff9b3ba72f87b632689e43c6922df365abbea4f
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.0MB