banload | 7dfedbaf8bc1656b942a4a28a859036cf82b8832b9d0ac2167e2836b406279f3

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-12-2023 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dfedbaf8bc1656b942a4a28a859036cf82b8832b9d0ac2167e2836b406279f3.dll
Size

2.8MB
MD5

508b225be9a6795f682acadd99c95070
SHA1

29600e270d4f2739771797c662591bbbfe1fc33a
SHA256

7dfedbaf8bc1656b942a4a28a859036cf82b8832b9d0ac2167e2836b406279f3
SHA512

4078e05d3c23be38755244ffccf55e1f26ff34b5f91ba0c2430d26a1333be788a3c23c4cf0769a22923331ef61e93e2fac265a4666eb49884f0725b663460f6e
SSDEEP

49152:dRTtP4NngsxkoTkV/fnmmgY16jtUoVDn99c1/0VXRH2Vt8b1+:FA+Hn5UjeuDnu0VX92VyM

Score

10^/10

banload downloader dropper persistence trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7dfedbaf8bc1656b942a4a28a859036cf82b8832b9d0ac2167e2836b406279f3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\InprocServer32	regsvr32.exe

Modifies registry class 63 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20213202-AE2E-4A01-81A1-0F0BA89F8887}\1.0\ = "Gem Table 2021 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5615F8D1-3C4C-41F8-90B6-7AEBD02E6147}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20213202-AE2E-4A01-81A1-0F0BA89F8887}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20213202-AE2E-4A01-81A1-0F0BA89F8887}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20213203-AE2E-4A01-81A1-0F0BA89F8887}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5615F8D1-3C4C-41F8-90B6-7AEBD02E6147}\ = "IDialogMapOptions"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5615F8D1-3C4C-41F8-90B6-7AEBD02E6147}\TypeLib\ = "{20213202-AE2E-4A01-81A1-0F0BA89F8887}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5615F8D1-3C4C-41F8-90B6-7AEBD02E6147}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20213202-AE2E-4A01-81A1-0F0BA89F8887}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20213203-AE2E-4A01-81A1-0F0BA89F8887}\TypeLib\ = "{20213202-AE2E-4A01-81A1-0F0BA89F8887}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5615F8D1-3C4C-41F8-90B6-7AEBD02E6147}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20213202-AE2E-4A01-81A1-0F0BA89F8887}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20213203-AE2E-4A01-81A1-0F0BA89F8887}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GemTable2021.Connect\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GemTable2021.Connect\CurVer\ = "GemTable2021.Connect.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GemTable2021.Connect.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5615F8D1-3C4C-41F8-90B6-7AEBD02E6147}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20213202-AE2E-4A01-81A1-0F0BA89F8887}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06A4FAA0-6924-17C2-9A4D-3754B1507C4F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GemTable2021.Connect\CLSID\ = "{20213201-AE2E-4A01-81A1-0F0BA89F8887}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20213203-AE2E-4A01-81A1-0F0BA89F8887}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20213203-AE2E-4A01-81A1-0F0BA89F8887}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5615F8D1-3C4C-41F8-90B6-7AEBD02E6147}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06A4FAA0-6924-17C2-9A4D-3754B1507C4F}\ = "{0000031A-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GemTable2021.Connect.1\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20213203-AE2E-4A01-81A1-0F0BA89F8887}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\TypeLib\ = "{20213202-AE2E-4A01-81A1-0F0BA89F8887}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20213202-AE2E-4A01-81A1-0F0BA89F8887}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20213203-AE2E-4A01-81A1-0F0BA89F8887}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5615F8D1-3C4C-41F8-90B6-7AEBD02E6147}\ = "IDialogMapOptions"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5615F8D1-3C4C-41F8-90B6-7AEBD02E6147}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GemTable2021.Connect\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7dfedbaf8bc1656b942a4a28a859036cf82b8832b9d0ac2167e2836b406279f3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20213203-AE2E-4A01-81A1-0F0BA89F8887}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\VersionIndependentProgID\ = "GemTable2021.Connect"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20213202-AE2E-4A01-81A1-0F0BA89F8887}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GemTable2021.Connect.1\CLSID\ = "{20213201-AE2E-4A01-81A1-0F0BA89F8887}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GemTable2021.Connect	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20213202-AE2E-4A01-81A1-0F0BA89F8887}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20213203-AE2E-4A01-81A1-0F0BA89F8887}\ = "IConnect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5615F8D1-3C4C-41F8-90B6-7AEBD02E6147}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5615F8D1-3C4C-41F8-90B6-7AEBD02E6147}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GemTable2021.Connect.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\AppID = "{20213201-AE2E-4A01-81A1-0F0BA89F8887}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\ProgID\ = "GemTable2021.Connect.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20213203-AE2E-4A01-81A1-0F0BA89F8887}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20213203-AE2E-4A01-81A1-0F0BA89F8887}\TypeLib\ = "{20213202-AE2E-4A01-81A1-0F0BA89F8887}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5615F8D1-3C4C-41F8-90B6-7AEBD02E6147}\TypeLib\ = "{20213202-AE2E-4A01-81A1-0F0BA89F8887}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GemTable2021.Connect\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20213203-AE2E-4A01-81A1-0F0BA89F8887}\ = "IConnect"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5615F8D1-3C4C-41F8-90B6-7AEBD02E6147}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5615F8D1-3C4C-41F8-90B6-7AEBD02E6147}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20213201-AE2E-4A01-81A1-0F0BA89F8887}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20213203-AE2E-4A01-81A1-0F0BA89F8887}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20213202-AE2E-4A01-81A1-0F0BA89F8887}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7dfedbaf8bc1656b942a4a28a859036cf82b8832b9d0ac2167e2836b406279f3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20213203-AE2E-4A01-81A1-0F0BA89F8887}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2028	regsvr32.exe
Token: SeIncBasePriorityPrivilege	2028	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7dfedbaf8bc1656b942a4a28a859036cf82b8832b9d0ac2167e2836b406279f3.dll
1⤵
- Checks BIOS information in registry
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-0-0x0000000002780000-0x000000000296A000-memory.dmp

Filesize
1.9MB

Download
memory/2028-10-0x0000000180000000-0x00000001804B7000-memory.dmp

Filesize
4.7MB

Download
memory/2028-12-0x0000000180000000-0x00000001804B7000-memory.dmp

Filesize
4.7MB

Download
memory/2028-13-0x0000000180000000-0x00000001804B7000-memory.dmp

Filesize
4.7MB

Download
memory/2028-15-0x0000000180000000-0x00000001804B7000-memory.dmp

Filesize
4.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads