banload | 871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845

Resubmissions

27-12-2024 19:40

241227-ydma1symep 10

27-12-2024 19:36

241227-yblayaykfy 10

Analysis

max time kernel
60s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
Size

3.9MB
MD5

415fdd816519e04471cdb6e54f7e7f95
SHA1

94b06d48ec16ac9411433624d5aa8eb98973c7d3
SHA256

871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845
SHA512

d7ff3e9a834ccde1f7e44268533dc42abc6af4b933e39c8ba6f2406975a4e6a8c60161e5a4b529fdcf87213b05827bc3b1789b65b977c8791151acc769e91d9a
SSDEEP

98304:RF8QUitE4iLqaPWGnEvK7RkOEEo+A7mOkO:RFQWEPnPBnEX3

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe

Renames multiple (222) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwresplm.dat.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\BackupRepair.m1v.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Microsoft AutoComplete"	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shell32.dll"	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Apartment"	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5056	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
Token: SeIncBasePriorityPrivilege	5056	871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe

C:\Users\Admin\AppData\Local\Temp\871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe
"C:\Users\Admin\AppData\Local\Temp\871f94756206d57420b846c762180555e69a451b7d18ae9bcf5171f855c51845.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini.tmp

Filesize
4.0MB

MD5
704e3d81a837ce2df20f17ff7afe54cf

SHA1
39d394d7f4985b28e3f7258caf39b42eaa606a92

SHA256
ebcccc934cd2668083bcb9ca518886da2e4ffd66e6c791acc8a2e9f02e20aeb4

SHA512
b6245a67f47ee241253f5e63f4b01926030fe5786f24a20d8157014db0de5cc3081ae2ba0e948afdecd30bd583c460c2946593cd24ed8dbf13e9b10ccd1f517c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
4.1MB

MD5
26970287a2104ad8d053953fae71e416

SHA1
8921659cdf3c6a6f88fafe5f1eba7eb9650c65cc

SHA256
50c710450b2a3df13000919bbcacac6187dc0deebebdf083747c3e13b68acdb3

SHA512
e6c0475b7f9f78d045102692e103912318bd440fc40c5d26de30906f832c110c4513e5d798669641534a385d5750db4e14c5a836a516f5e8e07f5550a0f6a8d2

Download Submit
memory/5056-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/5056-2-0x00000000043C0000-0x00000000045CC000-memory.dmp

Filesize
2.0MB

Download
memory/5056-8-0x00000000043C0000-0x00000000045CC000-memory.dmp

Filesize
2.0MB

Download
memory/5056-11-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/5056-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/5056-13-0x00000000043C0000-0x00000000045CC000-memory.dmp

Filesize
2.0MB

Download
memory/5056-37-0x00000000043C0000-0x00000000045CC000-memory.dmp

Filesize
2.0MB

Download
memory/5056-38-0x00000000043C0000-0x00000000045CC000-memory.dmp

Filesize
2.0MB

Download
memory/5056-103-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/5056-117-0x00000000043C0000-0x00000000045CC000-memory.dmp

Filesize
2.0MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads