Overview

overview

10

Static

static

3

871f947562...45.exe

windows7-x64

10

871f947562...45.exe

windows10-2004-x64

10

Resubmissions

27-12-2024 19:40

241227-ydma1symep 10

27-12-2024 19:36

241227-yblayaykfy 10

Analysis

  • max time kernel
    60s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    27-12-2024 19:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe

  • Size

    3.9MB

  • MD5

    415fdd816519e04471cdb6e54f7e7f95

  • SHA1

    94b06d48ec16ac9411433624d5aa8eb98973c7d3

  • SHA256

    871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845

  • SHA512

    d7ff3e9a834ccde1f7e44268533dc42abc6af4b933e39c8ba6f2406975a4e6a8c60161e5a4b529fdcf87213b05827bc3b1789b65b977c8791151acc769e91d9a

  • SSDEEP

    98304:RF8QUitE4iLqaPWGnEvK7RkOEEo+A7mOkO:RFQWEPnPBnEX3

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (175) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
    "C:\Users\Admin\AppData\Local\Temp\871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini.tmp
    Filesize

    4.0MB

    MD5

    133ddefa9649d34a4d0b7c2aed1aa7a4

    SHA1

    cc8c75ec851ac3c9618b5d6b43acf34216a152f5

    SHA256

    bdfa57d098b5166f1b3e6af183ae933b80509e16899439310402b0a6906fad63

    SHA512

    de35690291700685f3ce397cc69aed841c80174a9e70018d78e59bf688d0d459ca05a13d3e710db50b5cbc2b03e41a8812fce7c1eaadf1da0a2e233ffbcd3514

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    4.0MB

    MD5

    83bec0edcf2708fc3e4e865aca1b7b0d

    SHA1

    e10831088b7e242e7228b49e8dd1358847a8850e

    SHA256

    92a391c490b6cb7155021cb0e3e6f0d0a3ff7853b5c4e362ee6fa67dd9cf4b94

    SHA512

    6915a594f9f5c731d0c19f49aa2b860c4663afc861bcb690f83770d38802669e8cd6613fb1a9478422aaa93565d75da158457a6c1ea30650a36652b23f60a36d

    Download Submit

  • memory/2556-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2556-1-0x00000000030A0000-0x00000000032AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2556-8-0x00000000030A0000-0x00000000032AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2556-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2556-11-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2556-13-0x00000000030A0000-0x00000000032AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2556-25-0x00000000030A0000-0x00000000032AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2556-41-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2556-45-0x00000000030A0000-0x00000000032AC000-memory.dmp

    Filesize

    2.0MB

    Download