banload | 15924de08b8e68e6bf0f42db7a7f90ca6a4ee7f49a0b1c84bcb700f04ad0c259

General

Target

2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Size

3.1MB
MD5

347b36518d13cd02a1b31935757a2b53
SHA1

4080457bc1382d3089222d0f07349d6d7eaf4195
SHA256

15924de08b8e68e6bf0f42db7a7f90ca6a4ee7f49a0b1c84bcb700f04ad0c259
SHA512

71c124dd61f5f2d41fb840f392dde13d4880020bc8bae8a95e1b96fbabc7f13bcf2c7d4e57977711cebbe632de4c530f6902ffc0f103e760fa1d6381c9141db1
SSDEEP

49152:LM5mP+GC4S0Ts0k//p5Oz/968B1ECYJgkYe3m4txzZ15tU:LMYPpC10G/p5OzF68B+5Jee3m0xltU

Score

10^/10

banload downloader dropper trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe

Modifies registry class 23 IoCs

Processes:

2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\shell\restorelibraries\command	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\ShellFolder	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\ShellFolder\FolderValueFlags = "270880"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\System.PropList.DetailsPaneNullSelect = "prop:"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\System.PropList.DetailsPaneNullSelectTitle = "prop:"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\shell	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\ShellFolder\Attributes = "2961178893"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\DefaultIcon\ = "%SystemRoot%\\SysWow64\\imageres.dll,-1023"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InProcServer32\ThreadingModel = "Both"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\shell\restorelibraries	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\shell\restorelibraries\Description = "@shell32.dll,-34646"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\ = "UsersLibraries"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\LocalizedString = "@%SystemRoot%\\system32\\windows.storage.dll,-50691"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\SortOrderIndex = "84"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\System.IsPinnedToNameSpaceTree = "0"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\shell\restorelibraries\SeparatorAfter = "1"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\shell\restorelibraries\SeparatorBefore = "1"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\shell\restorelibraries\command\DelegateExecute = "{c51b83e5-9edd-4250-b45a-da672ee3c70e}"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\DefaultIcon	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InProcServer32	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\InProcServer32\ = "%SystemRoot%\\SysWow64\\windows.storage.dll"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AD33BA1-4EFF-2C38-4B2D-FAC722146F1B}\shell\restorelibraries\MUIVerb = "@shell32.dll,-34645"	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe

description	pid	Process
Token: 33	1384	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
Token: SeIncBasePriorityPrivilege	1384	2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-09_347b36518d13cd02a1b31935757a2b53_mafia.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-1-0x0000000002BC0000-0x0000000002DC1000-memory.dmp

Filesize
2.0MB

Download
memory/1384-7-0x0000000002BC0000-0x0000000002DC1000-memory.dmp

Filesize
2.0MB

Download
memory/1384-8-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1384-14-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1384-17-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1384-16-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1384-13-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1384-15-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1384-18-0x0000000002BC0000-0x0000000002DC1000-memory.dmp

Filesize
2.0MB

Download
memory/1384-20-0x0000000002BC0000-0x0000000002DC1000-memory.dmp

Filesize
2.0MB

Download
memory/1384-22-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads