Overview

overview

10

Static

static

3

7a864df506...12.exe

windows7-x64

10

7a864df506...12.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    60s
  • max time network
    35s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-12-2024 19:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe

  • Size

    3.8MB

  • MD5

    0b4ddc7001a82f402b7f8077b2bbfa2e

  • SHA1

    c34fbd79bda7787e6b490bb025eb12f08730a897

  • SHA256

    7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512

  • SHA512

    dd8c69f345e31b68ace8ad6b3ce89748dd2e1549e45ab5f0478d44b43df22c61e41d7eb2021670c1a8d9ea8a90d1d40d08ba521c32c749604bb8adceebcce54e

  • SSDEEP

    98304:RF8QUitE4iLqaPWGnEvK7RkOEEo+A7mOkp:RFQWEPnPBnEXQ

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (218) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe
    "C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini.tmp
    Filesize

    4.0MB

    MD5

    17679f1d2769067c6777a59e74201773

    SHA1

    cf7d1729207743c5329abcaa4077e61017fd9e72

    SHA256

    d01d0f07f5cb7f20f5313fe9fdd5c457ea297d15d8748fdfae23f0864aa3b453

    SHA512

    45eb6d5495840fc5a94e5bafc3ec6da3ddac7bdd32d247dd885eac30baddcf4c93ea2e43c0e108b23fc0c35127d1acc5c437ae27298913d6594ee2e0d6f3c710

    Download Submit

  • C:\Program Files\7-Zip\7-zip.dll.tmp
    Filesize

    4.0MB

    MD5

    1dd12b869979b5e1057106a2c8b48b9c

    SHA1

    053331e7fbce5ef505693e9baea9622302473755

    SHA256

    5dfa0b5ca609f8d1e3f4846682fe233c39394703e7beba4cf7260200e93b39c8

    SHA512

    b869b78dca540465a2429851ce48572adf680f666b4d82bbaf3d7f784617d62b419c05d4f05962c8676842ca0ad61ad2968c25a73323240e1afa801732b2a17e

    Download Submit

  • memory/384-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/384-2-0x0000000004940000-0x0000000004B4C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/384-9-0x0000000004940000-0x0000000004B4C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/384-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/384-13-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/384-14-0x0000000004940000-0x0000000004B4C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/384-43-0x0000000004940000-0x0000000004B4C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/384-42-0x0000000004940000-0x0000000004B4C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/384-116-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/384-132-0x0000000004940000-0x0000000004B4C000-memory.dmp

    Filesize

    2.0MB

    Download