banload | 1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c

General

Target

1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe
Size

6.1MB
MD5

63b9123b8628da85960afa32622f3351
SHA1

88f88598e00790c9458c64ac2d01c8c86eb55d2d
SHA256

1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c
SHA512

369d347327c866fa96aae69c18c8c040d4d2236156e9f949af77d954e541a82e4e946c1c107c0da21a5811d7e9c93007a61bf3c0a907845012016c8da6399f68
SSDEEP

196608:p8G1WGKhPnsw49+s1bU6nFLOyomFHKnP:p8G1N4nsS36F

Score

10^/10

banload discovery downloader dropper evasion trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe

Modifies registry class 8 IoCs

Processes:

1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5CF82984-4380-8E3A-7C4C-63595381A810}\VersionIndependentProgID\ = "EntityDataHandler.EntityDataHandler"	1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5CF82984-4380-8E3A-7C4C-63595381A810}	1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5CF82984-4380-8E3A-7C4C-63595381A810}\InprocServer32	1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5CF82984-4380-8E3A-7C4C-63595381A810}\InprocServer32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\ENTITY~2.DLL"	1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5CF82984-4380-8E3A-7C4C-63595381A810}\InprocServer32\ThreadingModel = "Apartment"	1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5CF82984-4380-8E3A-7C4C-63595381A810}\ProgID	1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5CF82984-4380-8E3A-7C4C-63595381A810}\ProgID\ = "EntityDataHandler.EntityDataHandler.1"	1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5CF82984-4380-8E3A-7C4C-63595381A810}\VersionIndependentProgID	1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe

description	pid	Process
Token: 33	1968	1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe
Token: SeIncBasePriorityPrivilege	1968	1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe

C:\Users\Admin\AppData\Local\Temp\1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe
"C:\Users\Admin\AppData\Local\Temp\1dc5e73b01d0338d6d3f63906571bc49944107492b038a08088d0676fc313d9c.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-0-0x0000000002C00000-0x0000000002E00000-memory.dmp

Filesize
2.0MB

Download
memory/1968-6-0x0000000002C00000-0x0000000002E00000-memory.dmp

Filesize
2.0MB

Download
memory/1968-7-0x0000000000400000-0x0000000000D6A000-memory.dmp

Filesize
9.4MB

Download
memory/1968-11-0x0000000000400000-0x0000000000D6A000-memory.dmp

Filesize
9.4MB

Download
memory/1968-13-0x0000000000400000-0x0000000000D6A000-memory.dmp

Filesize
9.4MB

Download
memory/1968-10-0x0000000000400000-0x0000000000D6A000-memory.dmp

Filesize
9.4MB

Download
memory/1968-14-0x0000000000400000-0x0000000000D6A000-memory.dmp

Filesize
9.4MB

Download
memory/1968-15-0x0000000000400000-0x0000000000D6A000-memory.dmp

Filesize
9.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads