Overview
overview
7Static
static
3DataBankInstaller.exe
windows10-2004-x64
7DataBankInstaller.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$TEMP/7z.dll
windows10-2004-x64
3$TEMP/7z.dll
windows11-ltsc_2024-x64
3$TEMP/7z.exe
windows10-2004-x64
3$TEMP/7z.exe
windows11-ltsc_2024-x64
Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DataBankInstaller.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
DataBankInstaller.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$TEMP/7z.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$TEMP/7z.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
$TEMP/7z.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
$TEMP/7z.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target DataBankInstaller.exe
- Size 949KB
- Sample260812-ppqcdacf36
- SHA256 a604bd3916f80589f40e87fd5d801babbedf14c272e506a3f5e243f5c508addb
- MD5 fd183c1a57f24e9650cf415999d4abd4
- SHA1 fcc149ac6d9be0fbdee567e786589128ffe42ae7
- SHA512 600b1390196275386f773129254c8b629b0079b2857d8aeec3d7e4d5f90505c49c9ea63d22b5220ef3fcf949d5ddcf8fd1a02e49df159f1110fd931eac47c198
- SSDEEP 24576:pyWZ2I/PqPkkQtpT3TfxikKeRX/pNr6b/0XXlZc3r:ojkf+eRX/pN6T0lC3r
- TLSH T130252330B340D1A5F6523772AD72D1B36AF16B1EAD04EAE203605D0EBE51143E72F675
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5408 7z.exe - Loads dropped DLL 5 IoCs
pid Process 6128 DataBankInstaller.exe 6128 DataBankInstaller.exe 6128 DataBankInstaller.exe 6128 DataBankInstaller.exe 5408 7z.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_help_ka.qm 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_help_nl.qm 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\python3.dll 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\plugins\tls 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_he.qm 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\_vendor\Controlled Runtime Manager\databank_runtime_manager\package_manager.py 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\_vendor\Launcher Tool Browser\.pytest_cache\v\cache\nodeids 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\_vendor\Launcher Tool Browser\tests\test_access_resolver.py 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\api-ms-win-core-processenvironment-l1-1-0.dll 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\_socket.pyd 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\app\ui\messagebox.py 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\plugins\imageformats\qsvg.dll 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\plugins\imageformats\qwebp.dll 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_ka.qm 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\_vendor\Controlled Runtime Manager\.pytest_cache\CACHEDIR.TAG 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\app\ui\__init__.py 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\plugins\networkinformation 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\plugins\platforminputcontexts\qtvirtualkeyboardplugin.dll 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\_vendor\Launcher Tool Browser\.pytest_cache 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\libffi-8.dll 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\plugins\iconengines\qsvgicon.dll 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\_vendor\Controlled Runtime Manager\databank_runtime_manager\runtime_token.py 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\_vendor\Controlled Runtime Manager\databank_runtime_manager\__pycache__\manager.cpython-313.pyc 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\api-ms-win-core-heap-l1-1-0.dll 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\api-ms-win-core-namedpipe-l1-1-0.dll 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\plugins\platforms\qwindows.dll 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_help_uk.qm 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\api-ms-win-crt-environment-l1-1-0.dll 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\app\core\config.py 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\app\ui\__pycache__\create_user_dialog.cpython-313.pyc 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qtbase_gd.qm 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\logo\DatabankPipeline Logo.png 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\Qt6Qml.dll 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qtbase_en.qm 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_lg.qm 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_sk.qm 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_sv.qm 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\setuptools\_vendor\jaraco 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\_vendor\Launcher Tool Browser\databank_launcher_tool_browser\__pycache__\models.cpython-313.pyc 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\app\widgets\connection_panel.py 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\Qt6Quick.dll 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_de.qm 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_help_zh_TW.qm 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_tr.qm 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\_vendor\Controlled Runtime Manager\.pytest_cache\.gitignore 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\api-ms-win-core-synch-l1-1-0.dll 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\api-ms-win-core-synch-l1-2-0.dll 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\VCRUNTIME140.dll 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\_bz2.pyd 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\app\ui\__init__.py 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\MSVCP140.dll 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\Qt6Qml.dll 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_it.qm 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\Qt6VirtualKeyboard.dll 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_help_bg.qm 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_lv.qm 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_ru.qm 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\_vendor\Controlled Runtime Manager\tests 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\_vendor\Controlled Runtime Manager\databank_runtime_manager\__pycache__\models.cpython-313.pyc 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\api-ms-win-core-timezone-l1-1-0.dll 7z.exe File opened for modification C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\app\runtime\__pycache__\controlled_runtime.cpython-313.pyc 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\app\ui\login_window.py 7z.exe File created C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\MSVCP140_1.dll 7z.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DataBankInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7z.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 5408 7z.exe Token: 35 5408 7z.exe Token: SeSecurityPrivilege 5408 7z.exe Token: SeSecurityPrivilege 5408 7z.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 6128 wrote to memory of 5408 6128 DataBankInstaller.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\DataBankInstaller.exe"C:\Users\Admin\AppData\Local\Temp\DataBankInstaller.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\7z.exe"C:\Users\Admin\AppData\Local\Temp\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\DataBankLauncher.zip" -o"C:\Program Files (x86)\DataBank Launcher" -y2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5408
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\DataBank Launcher\DataBankLauncher\_internal\PySide6\translations\qt_help_en.qm
- Size 33B
- SHA256 494ac9a2b2cb2fdeced353f4a9f898ed8dcf616e9bc667438c62681e3f7f79cf
- MD5 aaea7ba475c961f941d0a23488457beb
- SHA1 2bf0054002c8f7d85dd080df332553bf9b3a8e26
- SHA512 5b408c36c8f93f71e73e3d3b1c0c2ad699e92a6088604b8adf8e588e8a75fc3fc92828199b7f00f5b05b224ae819220d07e56d610a76a267594870bec77172be
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7z.dll
- Size 1.3MB
- SHA256 c6989259a78960805b8b646843d2ef3a8a19e5533359e8a252aad2f3cc78c844
- MD5 30af07caeecb916f92f5817a04af61e0
- SHA1 2e07d972247685804705c5146eac124818bf1896
- SHA512 095b15e2ee689fe6509a6ef58ff1993d030c0aaf592a0d4c9a7cae68d5acb33714f928249d67e0f178f81703b8d68e938e34a2ca657e99975e0a6295be5ae9b9
- SSDEEP 24576:E0p4+kpYxuzmZlGU4j4j/M5TfhfYBSGZm9AE/0vA9g5eYoWbDuzY295M:E06+kpYtGU48/MlfR648A9Em029W
- TLSH T193559E11F7B1C0B4D58D5630862DBBBA50F8E729CA2068D777C0BE6E6F319D2C235A19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7z.exe
- Size 349KB
- SHA256 285e5220d6d4240b6a4bdb6357d427e457313376e3464d3cb973637a384ed02a
- MD5 e678c71771cf5c21f3e1f0c2ebf677bf
- SHA1 2b923e35b944a44a85e15da942999d24f3550163
- SHA512 38e2b486a32a244a57d8b07296f09c42ac003a05285f70fa9269fbe3533f82eeabbbcf20048f0772e02cf16f82b6496a46117b9c71ba8df1493fc1a0f0146e1e
- SSDEEP 6144:Ohisb84NXdM/vJh118TO4V1K2s8ipfQdvyHdh+XZbYHBC:O/hi/vH118Kg1KrqdReB
- TLSH T142747B127AE8E43AD2420131DB1AABA5E4F9D7684D71188337C81D6C2B75CD6D33AF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshFB06.tmp\NSISdl.dll
- Size 15KB
- SHA256 32e35e4b97f8df08f07d8879ba2ec963c75707440cfc0275e944a31c946f633f
- MD5 58696f9e1a48139fb1b0ed289a88f386
- SHA1 71ed08169cf00dd00d41d41395fd982ff8e8c5fd
- SHA512 3feac3983c39194d9101c803d69c395c33d8757e6ab746447f0f22ee9d0d8f790bb4f0c6c9f4fe7fae66cd6119c2b456c02ab051ffb62af4d010387998760d33
- SSDEEP 384:3rSQMCOUILnCaSPy/yhJzmGSMRWyOUKiR:3rSQMCOp0yamMRWysiR
- TLSH T15C623C16B62084F5CBB2167034D73B3E6BB28F6A1A2848C24BF35C4E9E52307B675D85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshFB06.tmp\System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshFB06.tmp\modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshFB06.tmp\nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshFB06.tmp\nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH