banload | 6772a00f6e3d8fe52b57148d7b2de6f2d0c016eb549fc439ee98ccb074e1eaec

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-01-2024 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6772a00f6e3d8fe52b57148d7b2de6f2d0c016eb549fc439ee98ccb074e1eaec.dll
Size

6.0MB
MD5

24a542900717d9f825b752930d474e8b
SHA1

2ffdb2641923001c88f62279afc466479f670495
SHA256

6772a00f6e3d8fe52b57148d7b2de6f2d0c016eb549fc439ee98ccb074e1eaec
SHA512

116ebbb655a34570b06c16db597766b75a4ceee6cde569ea5828907e1c563d7f2c2372ac087a5f80d6cac2b6a661670a3a72c2b56385f7af086b835a1aac5015
SSDEEP

98304:6c2A+qNXrFiuDnu0VX6VRfH3UVqTJ86wjFkZlxltXm:92A+uxDfB6VRfkQTK6zlxvXm

Score

10^/10

banload downloader dropper persistence trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	regsvr32.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\ = "C:\\Windows\\system32\\DDOIProxy.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6772a00f6e3d8fe52b57148d7b2de6f2d0c016eb549fc439ee98ccb074e1eaec.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect\CLSID\ = "{20163201-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect.1\CLSID\ = "{20163201-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\AppID = "{20163201-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\ = "IConnect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20163202-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\ = "Device Display Objects Proxies"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\ProgID\ = "NoteGem2016.Connect.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6772a00f6e3d8fe52b57148d7b2de6f2d0c016eb549fc439ee98ccb074e1eaec.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20163202-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\ = "C:\\Windows\\system32\\DDOIProxy.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6772a00f6e3d8fe52b57148d7b2de6f2d0c016eb549fc439ee98ccb074e1eaec.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20163202-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\VersionIndependentProgID\ = "NoteGem2016.Connect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\ = "Note Gem 2016 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\ = "IConnect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect.1\ = "Connect Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect\ = "Connect Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect\CurVer\ = "NoteGem2016.Connect.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2796	regsvr32.exe
Token: SeIncBasePriorityPrivilege	2796	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6772a00f6e3d8fe52b57148d7b2de6f2d0c016eb549fc439ee98ccb074e1eaec.dll
1⤵
- Checks BIOS information in registry
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2796-0-0x0000000002790000-0x000000000297A000-memory.dmp

Filesize
1.9MB

Download
memory/2796-10-0x0000000180000000-0x0000000180C7A000-memory.dmp

Filesize
12.5MB

Download
memory/2796-12-0x0000000180000000-0x0000000180C7A000-memory.dmp

Filesize
12.5MB

Download
memory/2796-13-0x0000000180000000-0x0000000180C7A000-memory.dmp

Filesize
12.5MB

Download
memory/2796-14-0x0000000180000000-0x0000000180C7A000-memory.dmp

Filesize
12.5MB

Download
memory/2796-16-0x0000000180000000-0x0000000180C7A000-memory.dmp

Filesize
12.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads