banload | 6772a00f6e3d8fe52b57148d7b2de6f2d0c016eb549fc439ee98ccb074e1eaec

Analysis

max time kernel
120s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-01-2024 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6772a00f6e3d8fe52b57148d7b2de6f2d0c016eb549fc439ee98ccb074e1eaec.dll
Size

6.0MB
MD5

24a542900717d9f825b752930d474e8b
SHA1

2ffdb2641923001c88f62279afc466479f670495
SHA256

6772a00f6e3d8fe52b57148d7b2de6f2d0c016eb549fc439ee98ccb074e1eaec
SHA512

116ebbb655a34570b06c16db597766b75a4ceee6cde569ea5828907e1c563d7f2c2372ac087a5f80d6cac2b6a661670a3a72c2b56385f7af086b835a1aac5015
SSDEEP

98304:6c2A+qNXrFiuDnu0VX6VRfH3UVqTJ86wjFkZlxltXm:92A+uxDfB6VRfkQTK6zlxvXm

Score

10^/10

banload downloader dropper persistence trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	regsvr32.exe

Registers COM server for autorun 1 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\Assembly = "Microsoft.Office.Interop.Word, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\Class = "Microsoft.Office.Interop.Word.LetterContentClass"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\RuntimeVersion = "v2.0.50727"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\15.0.0.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\15.0.0.0\Class = "Microsoft.Office.Interop.Word.LetterContentClass"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6772a00f6e3d8fe52b57148d7b2de6f2d0c016eb549fc439ee98ccb074e1eaec.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\15.0.0.0\Assembly = "Microsoft.Office.Interop.Word, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\15.0.0.0\RuntimeVersion = "v2.0.50727"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32	regsvr32.exe

Modifies registry class 56 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\15.0.0.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6772a00f6e3d8fe52b57148d7b2de6f2d0c016eb549fc439ee98ccb074e1eaec.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\VersionIndependentProgID\ = "NoteGem2016.Connect"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20163202-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\15.0.0.0\RuntimeVersion = "v2.0.50727"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect.1\CLSID\ = "{20163201-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\Class = "Microsoft.Office.Interop.Word.LetterContentClass"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect\CurVer\ = "NoteGem2016.Connect.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect\CLSID\ = "{20163201-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\Assembly = "Microsoft.Office.Interop.Word, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20163202-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\ = "IConnect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect.1\ = "Connect Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\15.0.0.0\Class = "Microsoft.Office.Interop.Word.LetterContentClass"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\ = "IConnect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\RuntimeVersion = "v2.0.50727"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\ProgID\ = "NoteGem2016.Connect.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20163203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20163202-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6772a00f6e3d8fe52b57148d7b2de6f2d0c016eb549fc439ee98ccb074e1eaec.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\AppID = "{20163201-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20163201-AE2E-4A01-81A1-0F0BA89F8884}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20163202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\ = "Note Gem 2016 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InprocServer32\15.0.0.0\Assembly = "Microsoft.Office.Interop.Word, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2016.Connect\CLSID	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4836	regsvr32.exe
Token: SeIncBasePriorityPrivilege	4836	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6772a00f6e3d8fe52b57148d7b2de6f2d0c016eb549fc439ee98ccb074e1eaec.dll
1⤵
- Checks BIOS information in registry
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4836-0-0x00000000027C0000-0x00000000029AA000-memory.dmp

Filesize
1.9MB

Download
memory/4836-7-0x0000000180000000-0x0000000180C7A000-memory.dmp

Filesize
12.5MB

Download
memory/4836-11-0x0000000180000000-0x0000000180C7A000-memory.dmp

Filesize
12.5MB

Download
memory/4836-13-0x0000000180000000-0x0000000180C7A000-memory.dmp

Filesize
12.5MB

Download
memory/4836-14-0x0000000180000000-0x0000000180C7A000-memory.dmp

Filesize
12.5MB

Download
memory/4836-15-0x0000000180000000-0x0000000180C7A000-memory.dmp

Filesize
12.5MB

Download
memory/4836-17-0x0000000180000000-0x0000000180C7A000-memory.dmp

Filesize
12.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads