banload | 308b78b0863496894408988970cce02a8782e26a40406d73259b062b7fa5e4df

General

Target

2024041479a7a5d87f09187725186977490d5553mafia.exe
Size

3.1MB
MD5

79a7a5d87f09187725186977490d5553
SHA1

fab5d80a0adfd6cf74165b2bbfde54fcf2004436
SHA256

308b78b0863496894408988970cce02a8782e26a40406d73259b062b7fa5e4df
SHA512

510f59ef6fa91c36e04bef5a0d41817496bb2539f02b4c1932e81be32426574d9561604c9a55ddca20afa44f3d6d9eb7ccf34f7d6b8cd122785d16b3ece67205
SSDEEP

98304:9AjPvAYY9K45qdmCzaXIelndfOYxAA21K:9AjPE9K2qcphdfOq321K

Score

10^/10

banload downloader dropper evasion trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2024041479a7a5d87f09187725186977490d5553mafia.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2024041479a7a5d87f09187725186977490d5553mafia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2024041479a7a5d87f09187725186977490d5553mafia.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\AppID = "{00021401-0000-0000-C000-000000000046}"	2024041479a7a5d87f09187725186977490d5553mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\InProcServer32\ThreadingModel = "Both"	2024041479a7a5d87f09187725186977490d5553mafia.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\OverrideFileSystemProperties\System.Kind = "1"	2024041479a7a5d87f09187725186977490d5553mafia.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\DisableProcessIsolation = "1"	2024041479a7a5d87f09187725186977490d5553mafia.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\NoOplock = "1"	2024041479a7a5d87f09187725186977490d5553mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\Implemented Categories\{00000003-0000-0000-C000-000000000046}	2024041479a7a5d87f09187725186977490d5553mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\OverrideFileSystemProperties	2024041479a7a5d87f09187725186977490d5553mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\shellex	2024041479a7a5d87f09187725186977490d5553mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\ProgID\ = "lnkfile"	2024041479a7a5d87f09187725186977490d5553mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\shellex\MayChangeDefaultMenu	2024041479a7a5d87f09187725186977490d5553mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}	2024041479a7a5d87f09187725186977490d5553mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\ = "Shortcut"	2024041479a7a5d87f09187725186977490d5553mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\Implemented Categories	2024041479a7a5d87f09187725186977490d5553mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\InProcServer32	2024041479a7a5d87f09187725186977490d5553mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\InProcServer32\ = "C:\\Windows\\SysWOW64\\windows.storage.dll"	2024041479a7a5d87f09187725186977490d5553mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{139EEB99-7F2C-ABF7-55F3-31E2C7C12B7B}\ProgID	2024041479a7a5d87f09187725186977490d5553mafia.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4376	2024041479a7a5d87f09187725186977490d5553mafia.exe
Token: SeIncBasePriorityPrivilege	4376	2024041479a7a5d87f09187725186977490d5553mafia.exe

C:\Users\Admin\AppData\Local\Temp\2024041479a7a5d87f09187725186977490d5553mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024041479a7a5d87f09187725186977490d5553mafia.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4376-0-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/4376-2-0x0000000002D70000-0x0000000002F5E000-memory.dmp

Filesize
1.9MB

Download
memory/4376-9-0x0000000002D70000-0x0000000002F5E000-memory.dmp

Filesize
1.9MB

Download
memory/4376-14-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/4376-15-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/4376-17-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/4376-18-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/4376-19-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/4376-20-0x0000000000400000-0x0000000000B00000-memory.dmp

Filesize
7.0MB

Download
memory/4376-21-0x0000000002D70000-0x0000000002F5E000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads