banload | 1bd3337a6c10520e8102e166f70981851b2e6144a3c600c23711c7de84af2b18

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AFD4216E93A82FEEBAFD3A68E9308CA4B0B54372.exe
Size

3.6MB
MD5

8ac04f77862e7778b0950e2beb397b79
SHA1

afd4216e93a82feebafd3a68e9308ca4b0b54372
SHA256

09d9b2d16b2ca0fe53edf26d1f22496d0205951a0be56c08625c9ffce365a35a
SHA512

61b386403ca5399d790c3cfed2f9983d553f14ebf375f505f5db20240d5c4b34be72cb87c847c36f522b36af7aa95a8bfa04d56183eb059372b8748fc1543a40
SSDEEP

49152:vi1yfyR535FTZJjPprVaHSVYdCdme3iN5l67MV4FeWaQgjJlwTnUkcNVuV9zwu:vi17RJJFKCdmeSN5lp6gtl

Score

10^/10

banload downloader dropper evasion trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AFD4216E93A82FEEBAFD3A68E9308CA4B0B54372.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AFD4216E93A82FEEBAFD3A68E9308CA4B0B54372.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	AFD4216E93A82FEEBAFD3A68E9308CA4B0B54372.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3A703FD7-12E3-A6C8-134F-8AD4E8B8C7DE}	AFD4216E93A82FEEBAFD3A68E9308CA4B0B54372.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3A703FD7-12E3-A6C8-134F-8AD4E8B8C7DE}\InprocServer32	AFD4216E93A82FEEBAFD3A68E9308CA4B0B54372.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3A703FD7-12E3-A6C8-134F-8AD4E8B8C7DE}\InprocServer32\ = "%SystemRoot%\\SysWow64\\NaturalLanguage6.dll"	AFD4216E93A82FEEBAFD3A68E9308CA4B0B54372.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3A703FD7-12E3-A6C8-134F-8AD4E8B8C7DE}\InprocServer32\ThreadingModel = "Both"	AFD4216E93A82FEEBAFD3A68E9308CA4B0B54372.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\ProgramData\TEMP:581C1FF6	AFD4216E93A82FEEBAFD3A68E9308CA4B0B54372.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2376	AFD4216E93A82FEEBAFD3A68E9308CA4B0B54372.exe
Token: SeIncBasePriorityPrivilege	2376	AFD4216E93A82FEEBAFD3A68E9308CA4B0B54372.exe

C:\Users\Admin\AppData\Local\Temp\AFD4216E93A82FEEBAFD3A68E9308CA4B0B54372.exe
"C:\Users\Admin\AppData\Local\Temp\AFD4216E93A82FEEBAFD3A68E9308CA4B0B54372.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2376-0-0x0000000000400000-0x0000000000A7A000-memory.dmp

Filesize
6.5MB

Download
memory/2376-1-0x00000000035D0000-0x00000000037D0000-memory.dmp

Filesize
2.0MB

Download
memory/2376-7-0x00000000035D0000-0x00000000037D0000-memory.dmp

Filesize
2.0MB

Download
memory/2376-13-0x0000000000400000-0x0000000000A7A000-memory.dmp

Filesize
6.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads