Overview

overview

10

Static

static

3

2025-04-09...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2025, 08:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-09_fb2b269302236eb4b3960dc0d570a31d_amadey_hawkeye_smoke-loader.exe

  • Size

    5.9MB

  • MD5

    fb2b269302236eb4b3960dc0d570a31d

  • SHA1

    42912f12f4c5fb83026204a663aea5051b1ad0da

  • SHA256

    3e87857f9eda3416070db632b47961892bfc4ec4a3eeed3749a7ec493851ea58

  • SHA512

    352cf339c580f1c54c88ad7237852260045e1de1526a23178bf6ba637a89e1f011b7ee182aa206863793768131ee5acbbe8cb6aacdabc9adf1625714fef771b8

  • SSDEEP

    98304:RF8QUitE4iLqaPWGnEv++q5MOApXmtF8Rfnrlr:RFQWEPnPBnEQi

Score
10/10
banloaddefense_evasiondiscoverydownloaderdropperransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Renames multiple (339) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-09_fb2b269302236eb4b3960dc0d570a31d_amadey_hawkeye_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-09_fb2b269302236eb4b3960dc0d570a31d_amadey_hawkeye_smoke-loader.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4448

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1279544337-3716153908-718418795-1000\desktop.ini.tmp
    Filesize

    6.1MB

    MD5

    79e961b25b1af9d2c3a05ff9c1d15654

    SHA1

    d0624e36d0290561b2af7d5ba6988840b01046dc

    SHA256

    e99fbefe1216fadb3f7edbeb8ce0c2f133f262bed8f158848f9311b3f563d97d

    SHA512

    4a9db4a3d48701e2997247b9537719a8e4e7a2dfda93e67e3f675b1ca1979ed879c40c62a9399bb0f024bcd6bd563894d16572f95de9a54d9f20d9b436fd63dd

    Download Submit

  • C:\fe11fc83a38900fcf766413d81eba9\2010_x86.log.html.tmp
    Filesize

    6.1MB

    MD5

    c74138e407d254bfc6601e5f51ee1411

    SHA1

    8ddabeb6e81e6de50e820ca9d01721f52b981e55

    SHA256

    2d3440f2d37ee83dd052af6cbe3b5ac15b01aef10db4e3a51d341d69a3bd58c6

    SHA512

    95a1b9ceed29aba1286759d86127ae79e9909f36c0edef643c6b5372007c0cf1fe62f1d1acf223f9ff5f4b566d049fd33afd856879fc3e59e13081237170492f

    Download Submit

  • memory/4448-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4448-2-0x00000000048E0000-0x0000000004AEC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4448-9-0x00000000048E0000-0x0000000004AEC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4448-13-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4448-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4448-14-0x00000000048E0000-0x0000000004AEC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4448-34-0x00000000048E0000-0x0000000004AEC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4448-35-0x00000000048E0000-0x0000000004AEC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4448-78-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4448-88-0x00000000048E0000-0x0000000004AEC000-memory.dmp

    Filesize

    2.0MB

    Download