banload | aa258dc2188ec9fff50f549e6e83c56269c58b2ae54824d57a73bc5da07127b6

General

Target

2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Size

2.9MB
MD5

fdceee90d6b1f1ad365e35b2bcfca354
SHA1

cc2b7122a48b0ce51111f9d11ee8bcae33970a18
SHA256

aa258dc2188ec9fff50f549e6e83c56269c58b2ae54824d57a73bc5da07127b6
SHA512

ca6356bcf95e9c9cc8271d9e0294a51b9973b58173a7593e59d8b95997bc757258b2f28934f195958c3c19d72dc144b2be4530e902f759a32f422741cc3acde7
SSDEEP

49152:CcuumjkAa7OTRffFfV6TFhHEizPqEMorqXspfWOZ9wkuGneCE:CcdAJkzkBEMornJZ9wj

Score

10^/10

banload downloader dropper trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\InprocServer32	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\ProgID	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\ = "AlphaImageLoader"	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\Implemented Categories\{C501EDBE-9E70-11D1-9053-00C04FD9189D}	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\InprocServer32\ = "C:\\Windows\\SysWOW64\\Dxtmsft.dll"	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\ToolBoxBitmap32\ = "C:\\Windows\\SysWOW64\\Dxtmsft.dll,235"	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\VersionIndependentProgID\ = "DXImageTransform.Microsoft.AlphaImageLoader"	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\ProgID\ = "DXImageTransform.Microsoft.AlphaImageLoader.1"	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\ToolBoxBitmap32	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\VersionIndependentProgID	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\InprocServer32\ThreadingModel = "Both"	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\Programmable	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\Implemented Categories	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1648	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
Token: SeIncBasePriorityPrivilege	1648	2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-24_fdceee90d6b1f1ad365e35b2bcfca354_magniber.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-0-0x0000000000400000-0x00000000007EB000-memory.dmp

Filesize
3.9MB

Download
memory/1648-2-0x0000000002B10000-0x0000000002D16000-memory.dmp

Filesize
2.0MB

Download
memory/1648-9-0x0000000002B10000-0x0000000002D16000-memory.dmp

Filesize
2.0MB

Download
memory/1648-14-0x0000000000400000-0x00000000007EB000-memory.dmp

Filesize
3.9MB

Download
memory/1648-15-0x0000000000400000-0x00000000007EB000-memory.dmp

Filesize
3.9MB

Download
memory/1648-16-0x0000000000400000-0x00000000007EB000-memory.dmp

Filesize
3.9MB

Download
memory/1648-17-0x0000000000400000-0x00000000007EB000-memory.dmp

Filesize
3.9MB

Download
memory/1648-18-0x0000000000400000-0x00000000007EB000-memory.dmp

Filesize
3.9MB

Download
memory/1648-19-0x0000000002B10000-0x0000000002D16000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing