Analysis

  • max time kernel
    120s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-01-2025 17:50

General

  • Target

    67e1da8f9b5a94a16081cb53ead3f1734c2394c590f15e4936f24db320be9bf5N.exe

  • Size

    2.4MB

  • MD5

    b373fefeba66598af5ce36d185f93720

  • SHA1

    63d3a2c236875a9ae5a1e745df01e7a73544a0d3

  • SHA256

    67e1da8f9b5a94a16081cb53ead3f1734c2394c590f15e4936f24db320be9bf5

  • SHA512

    a02d5acbd900c669770442fa6ea43352bcafaebebc5c00dac9ebc705c804972c56a61dbdd236aea2776508074c29a95f2dbc66dc91dd180e05d2ea73e158bbeb

  • SSDEEP

    49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVSWJIUD:RF8QUitE4iLqaPWGnEvV

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Banload family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Renames multiple (718) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\67e1da8f9b5a94a16081cb53ead3f1734c2394c590f15e4936f24db320be9bf5N.exe
    "C:\Users\Admin\AppData\Local\Temp\67e1da8f9b5a94a16081cb53ead3f1734c2394c590f15e4936f24db320be9bf5N.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp

    Filesize

    2.5MB

    MD5

    484ccca22a19999588c7094f6b8500ea

    SHA1

    9167195a1bccb0b894022940ff013486d20ef248

    SHA256

    fe43eb1f9500a0e9e1d6e157f044a55a67455c2a526e23f979a63245625e5c9b

    SHA512

    56b25466bde6fa44ee7892aebb2cfef5c507166659f97375fe5c2d100590d42009392c5c686ba8faaf768507c93a4313032509c774dcbca2c4eef8de716a7a7e

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    2.6MB

    MD5

    d5a79ca374593ddfb6ba284e9315d671

    SHA1

    6ed97da7012a8500fe8f19728dea66358126b4d6

    SHA256

    2198907a36f343042c6192c598a73072a0caf67c6bd6f7a0017cb4649f46de63

    SHA512

    4a10031f174c1f475751c58c163c02d7d33f6c95b04c15db3ca1b6b61b65bec3ab6730899882715294889d0facfc0fec51bb2f4922a6b076fca11a8984ddc5ca

  • memory/4588-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

  • memory/4588-2-0x0000000004390000-0x000000000459C000-memory.dmp

    Filesize

    2.0MB

  • memory/4588-9-0x0000000004390000-0x000000000459C000-memory.dmp

    Filesize

    2.0MB

  • memory/4588-13-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

  • memory/4588-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

  • memory/4588-14-0x0000000004390000-0x000000000459C000-memory.dmp

    Filesize

    2.0MB

  • memory/4588-54-0x0000000004390000-0x000000000459C000-memory.dmp

    Filesize

    2.0MB

  • memory/4588-55-0x0000000004390000-0x000000000459C000-memory.dmp

    Filesize

    2.0MB

  • memory/4588-164-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

  • memory/4588-186-0x0000000004390000-0x000000000459C000-memory.dmp

    Filesize

    2.0MB