Malware Analysis Report

2025-01-22 23:08

Sample ID 241227-yaqt2aymbk
Target 871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3
SHA256 871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3

Threat Level: Known bad

The file 871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3 was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Renames multiple (195) files with added filename extension

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Renames multiple (221) files with added filename extension

Checks BIOS information in registry

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-27 19:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-27 19:35

Reported

2024-12-27 19:36

Platform

win7-20241010-en

Max time kernel

60s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A

Renames multiple (195) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\7z.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\tk.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\va.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\sv.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\ast.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\ja.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\ru.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\lv.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\si.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\gl.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\sl.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\yo.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\gu.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\kab.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\ms.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\de.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\io.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\ro.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\et.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\License.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\7zG.exe.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\cs.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\tr.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\fi.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\ky.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\be.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\he.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\tg.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\bg.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32\LocalServer32 = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b004f00550054004c004f004f004b00460069006c00650073003e005500330069006f006b006a0040004a0069003f0035007600320062006600790076003d0046002c0000000000 C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Outlook Office Finder" C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\OUTLOOK.EXE" C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe

"C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe"

Network

N/A

Files

memory/2992-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2992-1-0x0000000003120000-0x000000000332C000-memory.dmp

memory/2992-8-0x0000000003120000-0x000000000332C000-memory.dmp

memory/2992-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2992-13-0x0000000003120000-0x000000000332C000-memory.dmp

memory/2992-12-0x0000000000400000-0x0000000000616000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini.tmp

MD5 08acfa591e939224325dc08d34e6681b
SHA1 a9969a8f3b7f710d2e6fdcf29991ca054f7b5aaf
SHA256 1eae398064aa5d08e85b8788ba1651d4700c827e38dbe832977ba7fca95d41e6
SHA512 7b7c56dc9048d1bed58d2a321a7fe1ebc48f03bca34fbea981cb0e5cdb16a8f0326529b473ed8592e12a0d67c715c24b668d505caac715fd45339bd63aaaa159

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 bf37e951e4b51a4f3bd17672b9a9e981
SHA1 6a35068178fe1283d33267ac72a15409b455d0b0
SHA256 1a5c87c0dea261a8d5d9838b79d60b9d930f0ce0ae3eb8bc822acf69c16b0551
SHA512 6af159fec071bfc6cd52bd2555a61820731b5c5a2912ad413fcf35c0bd6d3d09f2288c61b6d8826fafb615099825a71794478806f111dba2aa09f9b050dd05ee

memory/2992-25-0x0000000003120000-0x000000000332C000-memory.dmp

memory/2992-41-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2992-47-0x0000000003120000-0x000000000332C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-27 19:35

Reported

2024-12-27 19:36

Platform

win10v2004-20241007-en

Max time kernel

60s

Max time network

54s

Command Line

"C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A

Renames multiple (221) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\eu.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\ka.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\uz.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\ar.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\sk.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwresplm.dat.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\hi.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\ne.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\7-Zip\Lang\tr.txt.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "PSFactoryBuffer" C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%systemroot%\\SysWow64\\comuid.dll" C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe

"C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp

Files

memory/1268-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1268-2-0x0000000004960000-0x0000000004B6C000-memory.dmp

memory/1268-9-0x0000000004960000-0x0000000004B6C000-memory.dmp

memory/1268-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1268-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1268-14-0x0000000004960000-0x0000000004B6C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp

MD5 55af2091c4e879d72b7052d0e10c6427
SHA1 081342155e671cedbb7b6081bfe4ba658234d0a6
SHA256 500010a2d0dc5ca987977f5b4d7d8dcf4cdcb9b5f16edd4559c0cd2de6da09f8
SHA512 0a808100bb91df219fd833387dc6b1f35ed46b7c61ff7f3d45ad7b3fe09799aed73043a81ac842a7060d78dcabea6fe4fec10d7abd49702194b4c2d8286bf0b2

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 d7df79ebf8f97e7347105311751b8651
SHA1 4424f8bb04029245038c66482ed258ac5c7f6caf
SHA256 d63f1d70b691ad332fc5d774f4700d6a97edab71da66370d2ac67d3bd0dbd0d1
SHA512 d80c7a5d9c468044a9b93dd654629782e826899b712a06026ca37268d811eabff235d7e3ced011cc5b7b8b26601ac036221a2bcbdba9811706c1bca23d330fae

memory/1268-49-0x0000000004960000-0x0000000004B6C000-memory.dmp

memory/1268-48-0x0000000004960000-0x0000000004B6C000-memory.dmp

memory/1268-134-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1268-152-0x0000000004960000-0x0000000004B6C000-memory.dmp