Overview

overview

10

Static

static

3

2025-03-14...ia.exe

windows7-x64

10

2025-03-14...ia.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2025, 04:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-14_eea6be70d84d4668a4aac9739a4a0d7c_mafia.exe

  • Size

    3.1MB

  • MD5

    eea6be70d84d4668a4aac9739a4a0d7c

  • SHA1

    56eb1a1354cd846632e4005e39a158b77726526b

  • SHA256

    0654e183ef58f3ab0f036690fe1a666eaef2387e622645dd8ca25cd1d19a7d85

  • SHA512

    b412531bed426c2fabda1a37120406e0b60cf54ed7328518e39926e481c2caede260fe2b614242a31a1088864e4d44050fa12412c91aa0fb2c0668bad9036c5c

  • SSDEEP

    49152:OuWJCbWiFqRTN/qYthAstP768B1ECYJgkFRrma2sx05tE:OugCSie/TthAstD68B+5J/RrmAxStE

Score
10/10
banloaddiscoverydownloaderdroppertrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 58 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-14_eea6be70d84d4668a4aac9739a4a0d7c_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-14_eea6be70d84d4668a4aac9739a4a0d7c_mafia.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Users\Admin\AppData\Local\Temp\2025-03-14_eea6be70d84d4668a4aac9739a4a0d7c_mafia.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-03-14_eea6be70d84d4668a4aac9739a4a0d7c_mafia.exe"
      2⤵
      • Checks BIOS information in registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      PID:2588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Licenses\085B818A496C028ED.Lic
    Filesize

    136B

    MD5

    ebe8e65c581ae2cad32967ef5c788692

    SHA1

    7a2ddfda8c5a7663e0e6aa65cc31a458bc51e130

    SHA256

    d5a1b5e83ccb74f2ff115ee05611b9106c5adf3e8a36aae0cc323a84947cb269

    SHA512

    57e12fdd196585ca4fd63b6ca6173606228ed2f0738b9640c573f9314bbe13a14bb7c9a8eff78a43ff37dfa6c526ca58b284a62f455c1316dfc54afd26a40374

    Download Submit

  • memory/2588-40-0x0000000002B50000-0x0000000002D51000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2588-28-0x0000000002B50000-0x0000000002D51000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2588-48-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/2588-43-0x0000000002B50000-0x0000000002D51000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2588-37-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/2588-38-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/2588-36-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/2588-39-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/2588-35-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/2588-22-0x0000000002B50000-0x0000000002D51000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2860-13-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/2860-2-0x0000000002AA0000-0x0000000002CA1000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2860-8-0x0000000002AA0000-0x0000000002CA1000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2860-20-0x0000000002AA0000-0x0000000002CA1000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2860-0-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/2860-14-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/2860-18-0x0000000002AA0000-0x0000000002CA1000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2860-15-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/2860-17-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/2860-44-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/2860-16-0x0000000000400000-0x00000000008B4000-memory.dmp

    Filesize

    4.7MB

    Download