banload | 3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54

General

Target

3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
Size

3.5MB
MD5

b132f310c93f7c8612343390a72367ef
SHA1

2dbf218754531f7d7fa4df21f19f692761e76468
SHA256

3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54
SHA512

7cc1e3e4728025d424d338d0526aa092250a08c473dd8c5170c5309b19c1c6210a8cd8097f6d98b574bb4a1a630670dc2e4d50ea7c23a9f01b5d6e8dbfb1b228

Score

10^/10

banload downloader dropper trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe

Modifies registry class 12 IoCs

Processes:

3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8CBCBC-408F-BADB-4EA5-2945C5EA4B14}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONFILTER.DLL"	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8CBCBC-408F-BADB-4EA5-2945C5EA4B14}\InprocServer32\ThreadingModel = "Both"	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8CBCBC-408F-BADB-4EA5-2945C5EA4B14}\ShellFolder\WANTSFORPARSING	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8CBCBC-408F-BADB-4EA5-2945C5EA4B14}\ShellFolder\Attributes = "538443776"	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8CBCBC-408F-BADB-4EA5-2945C5EA4B14}\VersionIndependentProgID	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8CBCBC-408F-BADB-4EA5-2945C5EA4B14}	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8CBCBC-408F-BADB-4EA5-2945C5EA4B14}\ = "Microsoft OneNote Namespace Extension for Windows Desktop Search"	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8CBCBC-408F-BADB-4EA5-2945C5EA4B14}\InprocServer32	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8CBCBC-408F-BADB-4EA5-2945C5EA4B14}\ProgID	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8CBCBC-408F-BADB-4EA5-2945C5EA4B14}\ProgID\ = "OneIndex.ShellFolder.1"	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8CBCBC-408F-BADB-4EA5-2945C5EA4B14}\ShellFolder	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B8CBCBC-408F-BADB-4EA5-2945C5EA4B14}\VersionIndependentProgID\ = "OneIndex.ShellFolder"	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe

description	pid	process
Token: 33	1376	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
Token: SeIncBasePriorityPrivilege	1376	3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe

C:\Users\Admin\AppData\Local\Temp\3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe
"C:\Users\Admin\AppData\Local\Temp\3b4cc40c3a09696d35002f25d0b56bbd7f1f82af8f2d41136fc1d2a84065fa54.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1376

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1376-55-0x00000000031B0000-0x0000000003320000-memory.dmp

Filesize
1.4MB

Download
memory/1376-61-0x00000000031B0000-0x0000000003320000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads