banload | a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee

General

Target

a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Size

2.9MB
MD5

3e41579ead92ce8368b2c1985539d510
SHA1

a20ae14e51b16b27b285d020aaa014ec94fb4bdb
SHA256

a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee
SHA512

c9ee45be8c2e00e66668831af1bb5479c603e387f02d6a41c4bbeb9c524b85bdc92f29d06f8bfc35746b2cfd8758d68fd64dca4359ec83f25eecf4377bff414b
SSDEEP

49152:1cuumjkA07OTRsaSfpwXTLWi5zPqEMorqXsomXVw2sAMKd70fwkuGn37:1cdAQindcEMor6m7Gwq

Score

10^/10

banload downloader dropper trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\InprocServer32\14.0.0.0\RuntimeVersion = "v2.0.50727"	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\ProgID	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\InprocServer32\14.0.0.0\Assembly = "Microsoft.Office.Interop.Outlook, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\InprocServer32\14.0.0.0	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\VersionIndependentProgID	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\Control	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\ToolboxBitmap32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\OUTLOOK.EXE,5509"	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\InprocHandler32\ = "ole32.dll"	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\ = "Microsoft Outlook Business Card Control"	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\InprocHandler32	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\InprocServer32\Assembly = "Microsoft.Office.Interop.Outlook, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\InprocServer32\RuntimeVersion = "v2.0.50727"	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\InprocServer32\14.0.0.0\Class = "Microsoft.Office.Interop.Outlook.OlkBusinessCardControlClass"	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\ToolboxBitmap32	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\ProgID\ = "Outlook.OlkBusinessCardControl.1"	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\Typelib\ = "{00062FFF-0000-0000-C000-000000000046}"	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\LocalServer32	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\Typelib	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\VersionIndependentProgID\ = "Outlook.OlkBusinessCardControl"	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\InprocServer32	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\InprocServer32\Class = "Microsoft.Office.Interop.Outlook.OlkBusinessCardControlClass"	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\OUTLOOK.EXE\""	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\Version	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79E636ED-FEB2-A50F-86EA-5164CDFC417E}\Version\ = "9.4"	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2896	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
Token: SeIncBasePriorityPrivilege	2896	a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe

C:\Users\Admin\AppData\Local\Temp\a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe
"C:\Users\Admin\AppData\Local\Temp\a69a6db6be2046090b294c59880230409167a82fe824b235af90506accd9c1ee.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2896-6-0x0000000002700000-0x0000000002906000-memory.dmp

Filesize
2.0MB

Download
memory/2896-1-0x0000000002700000-0x0000000002906000-memory.dmp

Filesize
2.0MB

Download
memory/2896-7-0x0000000000400000-0x00000000007EB000-memory.dmp

Filesize
3.9MB

Download
memory/2896-14-0x0000000000400000-0x00000000007EB000-memory.dmp

Filesize
3.9MB

Download
memory/2896-13-0x0000000000400000-0x00000000007EB000-memory.dmp

Filesize
3.9MB

Download
memory/2896-15-0x0000000000400000-0x00000000007EB000-memory.dmp

Filesize
3.9MB

Download
memory/2896-12-0x0000000000400000-0x00000000007EB000-memory.dmp

Filesize
3.9MB

Download
memory/2896-16-0x0000000002700000-0x0000000002906000-memory.dmp

Filesize
2.0MB

Download
memory/2896-17-0x0000000000400000-0x00000000007EB000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing