banload | 308b78b0863496894408988970cce02a8782e26a40406d73259b062b7fa5e4df

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024041479a7a5d87f09187725186977490d5553mafia.exe
Size

3.1MB
MD5

79a7a5d87f09187725186977490d5553
SHA1

fab5d80a0adfd6cf74165b2bbfde54fcf2004436
SHA256

308b78b0863496894408988970cce02a8782e26a40406d73259b062b7fa5e4df
SHA512

510f59ef6fa91c36e04bef5a0d41817496bb2539f02b4c1932e81be32426574d9561604c9a55ddca20afa44f3d6d9eb7ccf34f7d6b8cd122785d16b3ece67205
SSDEEP

98304:9AjPvAYY9K45qdmCzaXIelndfOYxAA21K:9AjPE9K2qcphdfOq321K

Score

10^/10

banload downloader dropper evasion trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2024041479a7a5d87f09187725186977490d5553mafia.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2024041479a7a5d87f09187725186977490d5553mafia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2024041479a7a5d87f09187725186977490d5553mafia.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}	2024041479a7a5d87f09187725186977490d5553mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\ = "Wininet Cache task object"	2024041479a7a5d87f09187725186977490d5553mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\AppID = "{3eb3c877-1f16-487c-9050-104dbcd66683}"	2024041479a7a5d87f09187725186977490d5553mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\InProcServer32	2024041479a7a5d87f09187725186977490d5553mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\InProcServer32\ = "%systemroot%\\SysWow64\\wininet.dll"	2024041479a7a5d87f09187725186977490d5553mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\InProcServer32\ThreadingModel = "Both"	2024041479a7a5d87f09187725186977490d5553mafia.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2072	2024041479a7a5d87f09187725186977490d5553mafia.exe
Token: SeIncBasePriorityPrivilege	2072	2024041479a7a5d87f09187725186977490d5553mafia.exe

C:\Users\Admin\AppData\Local\Temp\2024041479a7a5d87f09187725186977490d5553mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024041479a7a5d87f09187725186977490d5553mafia.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-0-0x0000000002920000-0x0000000002B0E000-memory.dmp

Filesize
1.9MB

Download
memory/2072-1-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/2072-8-0x0000000002920000-0x0000000002B0E000-memory.dmp

Filesize
1.9MB

Download
memory/2072-13-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/2072-14-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/2072-16-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/2072-17-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/2072-18-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/2072-19-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/2072-20-0x0000000002920000-0x0000000002B0E000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads