banload | a20a14118c2f06a1cc502095a1f18b3cb34ad75f1684f7ec26e24a68d4e3114c

General

Target

a20a14118c2f06a1cc502095a1f18b3cb34ad75f1684f7ec26e24a68d4e3114c.dll
Size

6.1MB
MD5

83ebf73dd3ae56cd3f80e15220f761f3
SHA1

3b6a69b0c1b4ddc916323e4c3fd93f0c59736d54
SHA256

a20a14118c2f06a1cc502095a1f18b3cb34ad75f1684f7ec26e24a68d4e3114c
SHA512

0a51c195d59444bdb5caf90a95f6fbdc690c5ed8acdce830cff3836a53c145bf71582dd7fdea5fad1fe1412075e241e62aba17d7b544e61492a3d67d78ec4ea9
SSDEEP

98304:LP02A+gsksQuDnu0VXdK3JitsiLTAMxWtlm:/A+xDfBdK36scTAMxClm

Score

10^/10

banload downloader dropper persistence privilege_escalation trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	regsvr32.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 52 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B3B1F35A-A92F-CA69-04D9-DC65C9DA8864}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\ = "IConnect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect\CLSID\ = "{20243201-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\ = "Note Gem 2024 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\AppID = "{20243201-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect\CurVer\ = "NoteGem2024.Connect.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a20a14118c2f06a1cc502095a1f18b3cb34ad75f1684f7ec26e24a68d4e3114c.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B3B1F35A-A92F-CA69-04D9-DC65C9DA8864}\InProcServer32\ = "C:\\Windows\\System32\\Windows.SharedPC.CredentialProvider.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect.1\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20243202-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20243202-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B3B1F35A-A92F-CA69-04D9-DC65C9DA8864}\ = "Windows.SharedPC.CredentialProvider"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect.1\CLSID\ = "{20243201-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\ProgID\ = "NoteGem2024.Connect.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\ = "IConnect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20243202-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\VersionIndependentProgID\ = "NoteGem2024.Connect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B3B1F35A-A92F-CA69-04D9-DC65C9DA8864}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B3B1F35A-A92F-CA69-04D9-DC65C9DA8864}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a20a14118c2f06a1cc502095a1f18b3cb34ad75f1684f7ec26e24a68d4e3114c.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect\ = "Connect Class"	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

regsvr32.exe

description pid process

Token: 33 3996 regsvr32.exe
Token: SeIncBasePriorityPrivilege 3996 regsvr32.exe

description	pid	process
Token: 33	3996	regsvr32.exe
Token: SeIncBasePriorityPrivilege	3996	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a20a14118c2f06a1cc502095a1f18b3cb34ad75f1684f7ec26e24a68d4e3114c.dll
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3996-1-0x0000000002A40000-0x0000000002C2A000-memory.dmp

Filesize
1.9MB

Download
memory/3996-13-0x0000000180000000-0x0000000180CBC000-memory.dmp

Filesize
12.7MB

Download
memory/3996-12-0x0000000180000000-0x0000000180CBC000-memory.dmp

Filesize
12.7MB

Download
memory/3996-10-0x0000000180000000-0x0000000180CBC000-memory.dmp

Filesize
12.7MB

Download
memory/3996-14-0x0000000180000000-0x0000000180CBC000-memory.dmp

Filesize
12.7MB

Download
memory/3996-16-0x0000000180000000-0x0000000180CBC000-memory.dmp

Filesize
12.7MB

Download

Analysis

Sharing