banload | 0d61072b68bd99ded6712167e8a225c7f5f7a35634f527dd24b23d3ea54fc33f

General

Target

2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
Size

2.0MB
MD5

b677d26884f0477b7968efc7fdd571ef
SHA1

cbd607000d799adef300ea6f7ceca0167dc33b15
SHA256

0d61072b68bd99ded6712167e8a225c7f5f7a35634f527dd24b23d3ea54fc33f
SHA512

dc5e9326b9772c7f6b6484ef89dae1cc4a3aea05b327e98e8aa69af012a69cfe0890d728bcca173c40754663b7481add946ba9f150c344dbe9ee7195ee8da058
SSDEEP

49152:4eXOAxMOkCWTonzCUsD85m7qnjJA0vdYvM:4e+AqOjWU1jJAM

Score

10^/10

banload downloader dropper trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3528EDFF-F245-78C2-7A54-F6C02B30499C}	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3528EDFF-F245-78C2-7A54-F6C02B30499C}\ = "Microsoft Word 6.0 - 7.0 Picture"	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3528EDFF-F245-78C2-7A54-F6C02B30499C}\AutoConvertTo\ = "{00020907-0000-0000-C000-000000000046}"	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3528EDFF-F245-78C2-7A54-F6C02B30499C}\DefaultIcon	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3528EDFF-F245-78C2-7A54-F6C02B30499C}\NotInsertable\	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3528EDFF-F245-78C2-7A54-F6C02B30499C}\TreatAs\ = "{00020906-0000-0000-C000-000000000046}"	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3528EDFF-F245-78C2-7A54-F6C02B30499C}\AutoConvertTo	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3528EDFF-F245-78C2-7A54-F6C02B30499C}\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE,1"	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3528EDFF-F245-78C2-7A54-F6C02B30499C}\NotInsertable	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3528EDFF-F245-78C2-7A54-F6C02B30499C}\ProgID	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3528EDFF-F245-78C2-7A54-F6C02B30499C}\ProgID\ = "Word.Picture.6"	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3528EDFF-F245-78C2-7A54-F6C02B30499C}\TreatAs	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	948	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
Token: SeIncBasePriorityPrivilege	948	2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_b677d26884f0477b7968efc7fdd571ef_mafia.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-0-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/948-2-0x0000000002C60000-0x0000000002E6D000-memory.dmp

Filesize
2.1MB

Download
memory/948-9-0x0000000002C60000-0x0000000002E6D000-memory.dmp

Filesize
2.1MB

Download
memory/948-14-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/948-15-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/948-16-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/948-17-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/948-18-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/948-19-0x0000000002C60000-0x0000000002E6D000-memory.dmp

Filesize
2.1MB

Download
memory/948-21-0x0000000002C60000-0x0000000002E6D000-memory.dmp

Filesize
2.1MB

Download
memory/948-23-0x0000000000400000-0x0000000000694000-memory.dmp

Filesize
2.6MB

Download
memory/948-24-0x0000000002C60000-0x0000000002E6D000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing