banload | 6abf9fcec5883b6e4d70810e60bd2d8a133a1a62bc28ca5d17dcc6f45d35214a

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PictoWords.exe
Size

3.3MB
MD5

6b4fa8b84b8736d7443105c94b7d0d69
SHA1

54918bedcaa3cb472c8cf4d7224682a3585333ca
SHA256

44c2a21ace6dbe42a5d41acebc2d9a357f11e73134e3bab60f394cc5512e753e
SHA512

ca449b683c3d18309210fc34474a12ae1e6280b980cb00a22cbcaadf7669cb4095468918c9913e5558b25148ee9d1c9ba1fa6df66c9b67e1352e1f1e88a6c6b9
SSDEEP

98304:IEE/Obvu8AfPS+u7tx5frlsMAbY4gQFwl2Uz:IEEEulvu75r2M2Y4gQF+Fz

Score

10^/10

banload downloader dropper evasion trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

PictoWords.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ PictoWords.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	PictoWords.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

PictoWords.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	PictoWords.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	PictoWords.exe

Loads dropped DLL 1 IoCs

Processes:

PictoWords.exe

pid process

2916 PictoWords.exe

pid	process
2916	PictoWords.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

PictoWords.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	PictoWords.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	PictoWords.exe

Modifies registry class 5 IoCs

Processes:

PictoWords.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8FDBD81-8F37-DC65-FF42-C9897C435945}\InprocServer32	PictoWords.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8FDBD81-8F37-DC65-FF42-C9897C435945}\InprocServer32\ = "%SystemRoot%\\SysWow64\\wmp.dll"	PictoWords.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8FDBD81-8F37-DC65-FF42-C9897C435945}\InprocServer32\ThreadingModel = "Apartment"	PictoWords.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8FDBD81-8F37-DC65-FF42-C9897C435945}	PictoWords.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8FDBD81-8F37-DC65-FF42-C9897C435945}\ = "WMPlayer ContentPropPage Class"	PictoWords.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PictoWords.exe

description pid process

Token: 33 2916 PictoWords.exe
Token: SeIncBasePriorityPrivilege 2916 PictoWords.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

PictoWords.exe

pid process

2916 PictoWords.exe

description	pid	process
Token: 33	2916	PictoWords.exe
Token: SeIncBasePriorityPrivilege	2916	PictoWords.exe

pid	process
2916	PictoWords.exe

C:\Users\Admin\AppData\Local\Temp\PictoWords.exe
"C:\Users\Admin\AppData\Local\Temp\PictoWords.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\iWin Games\PictoWords\registry.gcf

Filesize
203B

MD5
4ddf3c5ade6545f1d04f5e5c7a300c65

SHA1
239817cb4885fe88d8052fee1c4c5e3b9cc00318

SHA256
568a0e2c4f396528cbc342dc4b4bcc6724da76a1ff970a402f37f966551ba7cb

SHA512
c573336e117dd232e153c8d8dd83c454e196a7de961e20b8c45cd906baad2e5fe859ca9dd7ea2fa360081850cb3eb12d2f23fd7f1e89eed856a962461d59b0f7

Download Submit
C:\Users\Public\Documents\iWin Games\PictoWords\registry.gcf

Filesize
42B

MD5
c923a5be82dd338aca2ff1f543d59117

SHA1
e35d760649b978953dfffb558b200fa620ec549b

SHA256
40bd854b3465cf559ef025ffb81dc8d81c592d702c87ff072972f79092c7103b

SHA512
7e1ef668ce8f85fd9908109d481da8f82ed42cf072c57c7e4e3e97ee37780206342c7d2c9bf3e1710d2f8a90b8bc9685ebceb6576c5f3dffcd5831537fce93c5

Download Submit
C:\Users\Public\Documents\iWin Games\PictoWords\registry.gcf

Filesize
62B

MD5
79d759df579a0ec59247b2fed7331eb3

SHA1
f0ef6f68351888f25c5aed544cd93a7c6aae5157

SHA256
70c442fd95ab66f9d875167617cb28395ba1ed4c8e4610c7570e3d5721bbc9d2

SHA512
d2b7f86ec9d20a9f2156d89705ef8d503d70058c74e2f75e0cf17afd6272f4f0995a236afb91c3d77ab980e27500495a9f0d4a02be1d2bea585752af6e8c410a

Download Submit
C:\Users\Public\Documents\iWin Games\PictoWords\registry.gcf

Filesize
82B

MD5
11cbabfff10545122e7e8461196182ec

SHA1
853393c8e4d093fe7eb350a101583540a1fb1495

SHA256
fde957e6453ad8f8b8e41365af1dbe2c5cb2d0e4d03f8d4fd4b247a800430804

SHA512
d32f430aa6017167bb2236eeb1ecf71feb3bcbada1961abc7ec5bba38bdec13a9369e2dcbb354f49bb21edca9a6ac04b291d8a654f83e144045d8f5a37790ab7

Download Submit
C:\Users\Public\Documents\iWin Games\PictoWords\registry.gcf

Filesize
118B

MD5
815335d4d0a1fb483120fdcbd6c5f11b

SHA1
d7b2f995f1215726d7c2dea7459d763bb288a7ed

SHA256
9bae8c73df2526bebdd58f7073e81fc3f70c479bf6dde609870710e29d1f4d2d

SHA512
718009a3d1d5653c889f40665fdfe4ec9ae9f43810f25a1fd4fc0815eef8a07fa7c7ee7d858d3b443c361916f46bab56e8719a10e9ad531404673e61918a1f94

Download Submit
\Users\Admin\AppData\Local\Temp\tg.fl2

Filesize
1.4MB

MD5
12719eddaab9caeef28c6e58192f594b

SHA1
b2f674f3f7007371c42d2bcf09b839585ea20b61

SHA256
ff12ac1ec68351653211bb9b9b54c31b98a61104c79fce9ee6bd54ead969dae9

SHA512
fe89dddb0da97c810395cc6dae8bbfa73f09bde0fcf5e8b60834c432c5e0eb206c1bc846ea51ad7aabb5955d4c00e50fa26314361aae1fdde70a502331ef52ca

Download Submit
memory/2916-12-0x0000000000400000-0x00000000007C3000-memory.dmp

Filesize
3.8MB

Download
memory/2916-13-0x0000000000400000-0x00000000007C3000-memory.dmp

Filesize
3.8MB

Download
memory/2916-7-0x0000000000400000-0x00000000007C3000-memory.dmp

Filesize
3.8MB

Download
memory/2916-18-0x00000000026C0000-0x00000000028C0000-memory.dmp

Filesize
2.0MB

Download
memory/2916-14-0x00000000026C0000-0x00000000028C0000-memory.dmp

Filesize
2.0MB

Download
memory/2916-11-0x0000000000400000-0x00000000007C3000-memory.dmp

Filesize
3.8MB

Download
memory/2916-10-0x0000000000400000-0x00000000007C3000-memory.dmp

Filesize
3.8MB

Download
memory/2916-73-0x0000000000400000-0x00000000007C3000-memory.dmp

Filesize
3.8MB

Download
memory/2916-6-0x00000000026C0000-0x00000000028C0000-memory.dmp

Filesize
2.0MB

Download
memory/2916-0-0x00000000026C0000-0x00000000028C0000-memory.dmp

Filesize
2.0MB

Download
memory/2916-118-0x00000000026C0000-0x00000000028C0000-memory.dmp

Filesize
2.0MB

Download
memory/2916-120-0x0000000000400000-0x00000000007C3000-memory.dmp

Filesize
3.8MB

Download