Overview

overview

10

Static

static

3

2025-03-10...ia.exe

windows7-x64

10

2025-03-10...ia.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/03/2025, 09:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-10_49736562f838b77d4965801d98452def_mafia.exe

  • Size

    3.1MB

  • MD5

    49736562f838b77d4965801d98452def

  • SHA1

    5a6fed8a35c91f02672bc5b29f833d4e6ad53a89

  • SHA256

    82f2b4a9efe71dbaebd47d6a5f0f4f81ea5e107610745f12373bd706ab01eaa2

  • SHA512

    bea46fe161a992419ecbe5754bf294f18a229e36d88fb8ee99c888b8d57c247a53b180a4e620b1b93043868535fdd8dcddb5f822486110ed37e6c9a8c82484f4

  • SSDEEP

    49152:euWJCbWiLqRTNXYkier+1tgM68B1ECYJgkIlma2sx05tE:eugCSiwIPer+1tR68B+5JAmAxStE

Score
10/10
banloaddiscoverydownloaderdroppertrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 61 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-10_49736562f838b77d4965801d98452def_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-10_49736562f838b77d4965801d98452def_mafia.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:400
    • C:\Users\Admin\AppData\Local\Temp\2025-03-10_49736562f838b77d4965801d98452def_mafia.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-03-10_49736562f838b77d4965801d98452def_mafia.exe"
      2⤵
      • Checks BIOS information in registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      PID:4160

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Licenses\0F3444CB9E7EC53A1.Lic
    Filesize

    138B

    MD5

    4c6b32488e4f85f3587be86201d02080

    SHA1

    1abedf1c7b5daa0eabe5f6f621c4b05fdd5461df

    SHA256

    849252a427999346e063b00f877665a4f532bcf1b43980a2dc713ef3fcaa03e2

    SHA512

    adc9874b772bbba9d12e7cf45112de897c0bcf6a316e3b21cd510993a48020308fcb642b5edd8781ec7cf86e1bdd61cd1f1e9f92b3e9cdee1bb0acec16507f7b

    Download Submit

  • memory/400-2-0x0000000002A60000-0x0000000002C61000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/400-8-0x0000000002A60000-0x0000000002C61000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/400-13-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/400-15-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/400-17-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/400-16-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/400-14-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/400-18-0x0000000002A60000-0x0000000002C61000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/400-20-0x0000000002A60000-0x0000000002C61000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/400-0-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/400-44-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/4160-22-0x0000000002BB0000-0x0000000002DB1000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4160-37-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/4160-36-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/4160-35-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/4160-38-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/4160-40-0x0000000002BB0000-0x0000000002DB1000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4160-39-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/4160-43-0x0000000002BB0000-0x0000000002DB1000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4160-28-0x0000000002BB0000-0x0000000002DB1000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4160-47-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download