Overview

overview

10

Static

static

3

01e2b85bb4...9N.exe

windows7-x64

10

01e2b85bb4...9N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    03-01-2025 14:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    01e2b85bb4bdb685155af06dcbe13f168aab9668d449cbdc1c1de8c40098cf79N.exe

  • Size

    3.1MB

  • MD5

    428e0d6ee146e85a0b84c02390932cf0

  • SHA1

    ce4b98957be9996c0f39dcf9ee576dce4d763d6a

  • SHA256

    01e2b85bb4bdb685155af06dcbe13f168aab9668d449cbdc1c1de8c40098cf79

  • SHA512

    6a01d8d61e8e27f7ff611cbcfdc7971a01cab383c8a88ac3b0dbdff3ff4fb1210ca9b41c9a67c9cf83eb8c7680c66199e23c30cc7e626fc3cbec546150851431

  • SSDEEP

    49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVCUkULRvp:RF8QUitE4iLqaPWGnEvcUkUtx

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (180) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01e2b85bb4bdb685155af06dcbe13f168aab9668d449cbdc1c1de8c40098cf79N.exe
    "C:\Users\Admin\AppData\Local\Temp\01e2b85bb4bdb685155af06dcbe13f168aab9668d449cbdc1c1de8c40098cf79N.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp
    Filesize

    3.2MB

    MD5

    59782440f6974931ca413a86c2695b38

    SHA1

    4b991a55278170cfc2dde057d0a968f022fbbf33

    SHA256

    cf09c04345061856bbc1285e5124296b2ad513172c9ef20a0223a1152acc6409

    SHA512

    4421425f0da411e7cdbd50d9eddb48e40a4a7ffe4cb0afac1ee0d8b52a7e34b2084bec4f7ef6429461c07a70aea3a20ff5ad9aafea8a4c7af873a6b20371be45

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    3.2MB

    MD5

    e6c3df9337c533bfc745cf78f76d2982

    SHA1

    1b55d34accd17c27f39de660f5bb12e78036d7b9

    SHA256

    4b4c5a15dd9186d7b475493028b23f4e03b10ec69c463449937e99fbea3d4e8c

    SHA512

    ba9c59730243d7cba5ab43927c6372325d3887b4ca3fa4d12cccdd3d0f5cbba900d39783ec7a756ee6ab9b19552d97a57bb68d083dc7be6397fddf5e1fc67cf2

    Download Submit

  • memory/2596-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2596-1-0x0000000003030000-0x000000000323C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2596-8-0x0000000003030000-0x000000000323C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2596-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2596-11-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2596-13-0x0000000003030000-0x000000000323C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2596-23-0x0000000003030000-0x000000000323C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2596-27-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2596-31-0x0000000003030000-0x000000000323C000-memory.dmp

    Filesize

    2.0MB

    Download