Overview

overview

10

Static

static

3

694f0b5f02...14.exe

windows7-x64

10

694f0b5f02...14.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-01-2025 00:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    694f0b5f02a40b7678ada6f1fbc223e4b0f6d7255146089973506c2fec7df414.exe

  • Size

    2.7MB

  • MD5

    42f061bafdb03901e4936f82634d89a9

  • SHA1

    571a8dc91115d9d18329e9d7650107a157ffdc79

  • SHA256

    694f0b5f02a40b7678ada6f1fbc223e4b0f6d7255146089973506c2fec7df414

  • SHA512

    254e73edd8467f3797f915bd0c1186281c314dbb3ec6005ae6af99cabd9115b0bc06f63fbf77c53d6d87fa548fc924d3be3ea28a9de028195dea97cd631b7415

  • SSDEEP

    49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVCMu7hp4:RF8QUitE4iLqaPWGnEvgMJ

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (229) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\694f0b5f02a40b7678ada6f1fbc223e4b0f6d7255146089973506c2fec7df414.exe
    "C:\Users\Admin\AppData\Local\Temp\694f0b5f02a40b7678ada6f1fbc223e4b0f6d7255146089973506c2fec7df414.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp
    Filesize

    2.8MB

    MD5

    703a7d574725dbbc8696ea54169fdd79

    SHA1

    bff8a23e8d88d3a6c28522240f8fce64560ea761

    SHA256

    0562600be7cf7f4d1ef7e0c7365eab7e9705f4cbca857d679d1752c2321301e7

    SHA512

    cea4d3bcc25c74c3784443af0f929ee6a6d6b99aba5266293026539459b7c30c6706dafda0844fe427812ee99c070b4110f9cd2424ad3fd1dc440c13b31a78f5

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    2.8MB

    MD5

    c65ddfa6b42bcf7d4bcf5bff53a26390

    SHA1

    2e3870896ca1a087aa365e27ccdc56f074648659

    SHA256

    90e8581a021a8b5e1115878d20980c1a4d3b6a9bb7e10664238b1259b85021e0

    SHA512

    a998cdc1a78dab0251e05c640dc239412997696e1a1df6ab9b682d04aa6e8f93da6be27b55bb28cac8ad79779bc70b759b3f731ca953b2578a21af2a01cf7d49

    Download Submit

  • memory/3040-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/3040-1-0x00000000030A0000-0x00000000032AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3040-8-0x00000000030A0000-0x00000000032AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3040-11-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/3040-13-0x00000000030A0000-0x00000000032AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3040-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/3040-25-0x00000000030A0000-0x00000000032AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3040-43-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/3040-51-0x00000000030A0000-0x00000000032AC000-memory.dmp

    Filesize

    2.0MB

    Download