Analysis
-
max time kernel
60s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-12-2024 19:47
General
-
Target
0c8e206afac9f49721dcf36c596087a37462ee5be33de925ee8377f7fc5d6fe0.exe
-
Size
6.9MB
-
MD5
cdd29877b9558072f98482fa8b4debb9
-
SHA1
2bc64d0bfcff2573210440b8959774b32f2fdd09
-
SHA256
0c8e206afac9f49721dcf36c596087a37462ee5be33de925ee8377f7fc5d6fe0
-
SHA512
297a90929cf740f54ef8446ffa7b84d22310c0f60e80c4053677805038fe7411c8d74dc93b76a02be8f0667e8a24ddf3adfbafec190a7329222e7f43bcdf03ae
-
SSDEEP
196608:RFQWEPnPBnEmOKIbGFFQWEPnPBnEmOKIbGt:PEPnPBnbOejEPnPBnbOet
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Renames multiple (106) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Drops file in Program Files directory 23 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c8e206afac9f49721dcf36c596087a37462ee5be33de925ee8377f7fc5d6fe0.exe"C:\Users\Admin\AppData\Local\Temp\0c8e206afac9f49721dcf36c596087a37462ee5be33de925ee8377f7fc5d6fe0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.1MB
MD59073dc73b7a30d3a2d3e9b4b3c68e1b6
SHA10b3af4094781268ba3aea1ae3d6460b58429240d
SHA256d7fce491e8a06b52add12a81936296581eb82c48f8c7a6a7c7c5ad9bafafade5
SHA5121846d589f581ba848298741a6fb890cfe3b14f8b91d45c455f674f2b59ec6d92bbdf837b7e9554b47df172a4a534558ceb7ea609fa19eecd99a7ebc9d3a2b084
-
Filesize
7.1MB
MD556695c83072cd89293e8424ffab4bebf
SHA129560b916e6bb2208e3e5f0bf5dda3da9a9a795c
SHA25689985e05e3fb8d5b7db6530d3212c0825e3776d73093b2279f861796b9626507
SHA5124fa2f1df4d26e454e5492c263b66be46f74bc7896430b8a5c090b73fdee1442249bfa5454180d700338f3973c92d2f3a264605ca9dbf1ae9c72763f5e572688c
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.0MB