banload | 3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab

General

Target

3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe
Size

8.4MB
MD5

966301a75152b02042112073a4702302
SHA1

19b3c20c1dea7e16025f6bf4eaa31a3750e86110
SHA256

3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab
SHA512

2bf39d413f6620053be1d1664fe81a18d34006929e64b12e5a6c109c8d3672ec075891982290e450e1a90b982ff5b305dfa04fac30f43a70550ae57b3bea527d
SSDEEP

98304:ERdoZZt1X3Hu3V9ke3jP8tDywZa1GTYNy9qDC2E8npPF4yRoo/RG1hhNFYH4Ao:ERdonX+lb8tDyhDw9Slnzoo/RG1XYG

Score

10^/10

banload downloader dropper evasion persistence privilege_escalation trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\VersionIndependentProgID\ = "SrDrvWuHelper.SrDrvWuHelper"	3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}	3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\ = "SrDrvWuHelper Class"	3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\AppID = "{f32d97df-e3e5-4cb9-9e3e-0eb5b4e49801}"	3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32	3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32\ = "%systemroot%\\system32\\srhelper.dll"	3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32\ThreadingModel = "Both"	3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\VersionIndependentProgID	3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1656	3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe
Token: SeIncBasePriorityPrivilege	1656	3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe

C:\Users\Admin\AppData\Local\Temp\3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe
"C:\Users\Admin\AppData\Local\Temp\3a83b1c22e6cdc567b83f5000c9fdf84d7feb920eeb690ff38a294479c0933ab.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-0-0x0000000003B90000-0x0000000003D78000-memory.dmp

Filesize
1.9MB

Download
memory/1656-10-0x0000000000400000-0x0000000001C84000-memory.dmp

Filesize
24.5MB

Download
memory/1656-16-0x0000000000400000-0x0000000001C84000-memory.dmp

Filesize
24.5MB

Download
memory/1656-13-0x0000000000400000-0x0000000001C84000-memory.dmp

Filesize
24.5MB

Download
memory/1656-17-0x0000000000400000-0x0000000001C84000-memory.dmp

Filesize
24.5MB

Download
memory/1656-14-0x0000000000400000-0x0000000001C84000-memory.dmp

Filesize
24.5MB

Download
memory/1656-15-0x0000000000400000-0x0000000001C84000-memory.dmp

Filesize
24.5MB

Download
memory/1656-19-0x0000000000400000-0x0000000001C84000-memory.dmp

Filesize
24.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads