Overview

overview

10

Static

static

3

1ebabb7de8...dN.exe

windows7-x64

10

1ebabb7de8...dN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    04-01-2025 06:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1ebabb7de83b022004f8db77718d207646afe5f8aa0d969afb9beffac152d3fdN.exe

  • Size

    3.4MB

  • MD5

    4917f091e084dd76d27ffd7aebaeb0e0

  • SHA1

    b97e9fb54bb60fea6e6b56d594fbaf0db7f02b55

  • SHA256

    1ebabb7de83b022004f8db77718d207646afe5f8aa0d969afb9beffac152d3fd

  • SHA512

    831168a9ba713051130caa779a9682443ed090be0f5cd8150be8b1e9ad6595e45b91060cb4a41e2cc5055362b04ab75b2b3c368b067951d5b13cb09946e0fbb9

  • SSDEEP

    49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV8u/kUHHkLZGqdIya:RF8QUitE4iLqaPWGnEvS9E6Iya

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (141) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 58 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ebabb7de83b022004f8db77718d207646afe5f8aa0d969afb9beffac152d3fdN.exe
    "C:\Users\Admin\AppData\Local\Temp\1ebabb7de83b022004f8db77718d207646afe5f8aa0d969afb9beffac152d3fdN.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2280

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp
    Filesize

    3.5MB

    MD5

    d4a3b5a7f091085767a52a00fce28e58

    SHA1

    dcbd79a5c9eae5a7634a93902017b03ee9fc25f6

    SHA256

    e774d9f51513d7308d3fd104d08a82e268b429ed0e4bb40d88e8b243ab6dc690

    SHA512

    f81950b0e4ab93b37cd64ac1ad51abef86b9bf56e512044cbc4f073f2f42979efd2b705a87731d741306d83e2827aa202c696f16dc9e11c51868042f30452921

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    3.6MB

    MD5

    55b7628279d171661665e743d70d2d9d

    SHA1

    405b6f1549671978f83fa802afece259a12a1629

    SHA256

    52c8bee396f8c0317375fc1d9e7ab7af22aefabad6157bf47195d61bc8274f86

    SHA512

    1fed6564675c16377b35edfc86dd10ece8cd467f35945b6bea05cc9fc78eb9c1f311769d50b71495731e7e513e277199fe76ac5d7c020a5342b149b307264225

    Download Submit

  • memory/2280-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2280-8-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2280-1-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2280-11-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2280-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2280-13-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2280-21-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2280-27-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2280-29-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download