Overview

overview

10

Static

static

3

0d37a9ad99...f7.exe

windows7-x64

10

0d37a9ad99...f7.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    07-01-2025 15:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe

  • Size

    3.7MB

  • MD5

    db358bf02b161dfe254dbf9e993fce8f

  • SHA1

    140ee2d9e67a82ac072766c0fefeac5ddf94d326

  • SHA256

    0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7

  • SHA512

    55fb0a70b4f111458c23e9ddf473f9657831083d2f78a181f710f602cb15fdf8b833d7afb653c3c3da40097614c80a5ed41cfbb41b410a0dca9c98a17f1e69b0

  • SSDEEP

    98304:RF8QUitE4iLqaPWGnEvK7RkOEEo+A7mOk3oC:RFQWEPnPBnEXm

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (154) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
    "C:\Users\Admin\AppData\Local\Temp\0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp
    Filesize

    3.9MB

    MD5

    c626fce88b67315469ef8174c1b49d48

    SHA1

    3d3aef88801a119937fde2da776d7eab56b52e96

    SHA256

    ce1e05d9abeda58bfc2cca12fee7db04ca7dc8aaaabced59dfebf9cf88e0c514

    SHA512

    414c3b8d81809c8c8f6a31315cb1f833f4174ae6f8e7145b3af0cec731bd501f59eb0d0720cd606810cb81db53b638cb6e327e5c4634f08628bd29b77f96cf7a

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    3.9MB

    MD5

    f149449f786b21cd818eb3eb8257a2ad

    SHA1

    5273fb25d166667dac1dde16320e9c4a6033c273

    SHA256

    0b63ae5a7683be218299e8a18cc660c1be5f01a45e97dc319d19fdb7f5b044fd

    SHA512

    5305298b12dd26485bf04beb01d52ed9a47624300e0e81c5f53515976c2e61088747af664303e71dfb5afa1b233ede2aaa189c4b8732eb11534b06682108ca80

    Download Submit

  • memory/2380-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2380-1-0x0000000003000000-0x000000000320C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2380-8-0x0000000003000000-0x000000000320C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2380-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2380-11-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2380-13-0x0000000003000000-0x000000000320C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2380-21-0x0000000003000000-0x000000000320C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2380-27-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2380-31-0x0000000003000000-0x000000000320C000-memory.dmp

    Filesize

    2.0MB

    Download