banload | 4e65c1447b4c6323b75ee34da729b72c347c5d478f45e559c9a518d89cf38a19

General

Target

2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Size

3.4MB
MD5

9142e9dd7d03b14658299f311c8fa90a
SHA1

e5ca58f8bfc1fbf6a61eba7ea529a4ac399b3f0f
SHA256

4e65c1447b4c6323b75ee34da729b72c347c5d478f45e559c9a518d89cf38a19
SHA512

7114da6af6b3eaaf3b54e528128360ebc4fef137a5e6ef0d3396395ad26af5ff4786e97157269050133729e7927338282ed2e5c7aed6f89e651af8ad7892398c
SSDEEP

98304:uXWa4C+4so1VH/4DjDxH81vBN07O7EZN1oprg:uXWD4so1ku5g

Score

10^/10

banload downloader dropper trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe

Modifies registry class 20 IoCs

Processes:

2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\InprocServer32\8.0.0.0	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\InprocServer32\8.0.0.0\Assembly = "Microsoft.JScript, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\ProgId	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\Implemented Categories	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\InprocServer32	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\InprocServer32\Assembly = "Microsoft.JScript, Version=7.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\InprocServer32\7.0.5000.0	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\Implemented Categories\{62C8FE65-4EBB-45E7-B440-6E39B2CDBF29}	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\InprocServer32\7.0.5000.0\Assembly = "Microsoft.JScript, Version=7.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\InprocServer32\7.0.5000.0\RuntimeVersion = "v1.1.4322"	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\InprocServer32\8.0.0.0\RuntimeVersion = "v2.0.50727"	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\InprocServer32\Class = "Microsoft.JScript.JSAuthor"	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\InprocServer32\RuntimeVersion = "v1.1.4322"	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\InprocServer32\ = "mscoree.dll"	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\InprocServer32\7.0.5000.0\Class = "Microsoft.JScript.JSAuthor"	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\ProgId\ = "Microsoft.JScript.JSAuthor"	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\ = "Microsoft.JScript.JSAuthor"	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\InprocServer32\ThreadingModel = "Both"	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B51498D-B752-5A26-7B6F-2BE15D6519E7}\InprocServer32\8.0.0.0\Class = "Microsoft.JScript.JSAuthor"	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe

description	pid	Process
Token: 33	1212	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
Token: SeIncBasePriorityPrivilege	1212	2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-8-0x00000000026C0000-0x00000000028CD000-memory.dmp

Filesize
2.1MB

Download
memory/1212-7-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/1212-0-0x00000000026C0000-0x00000000028CD000-memory.dmp

Filesize
2.1MB

Download
memory/1212-16-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/1212-17-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/1212-20-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/1212-18-0x00000000026C0000-0x00000000028CD000-memory.dmp

Filesize
2.1MB

Download
memory/1212-15-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/1212-14-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/1212-13-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/1212-21-0x00000000026C0000-0x00000000028CD000-memory.dmp

Filesize
2.1MB

Download
memory/1212-23-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/1212-25-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/1212-26-0x00000000026C0000-0x00000000028CD000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads