banload | 80cf65a80c75a5a31c280588d292888aebfe6a98a60a4a54d57b7f91562369ca

General

Target

80cf65a80c75a5a31c280588d292888aebfe6a98a60a4a54d57b7f91562369ca.dll
Size

6.1MB
MD5

2a76bc075546653076bff642720a7d93
SHA1

f84697fec682679b12291e8f00f47a92869e7a9a
SHA256

80cf65a80c75a5a31c280588d292888aebfe6a98a60a4a54d57b7f91562369ca
SHA512

156e5d65b66d23d0de617872c3ab1175c9be604c40be778e335e88b957d93ac7bbdfef2cdd55eae2a00cc926029298e53936f0612f4d8987ec90d0eaa29a38bd
SSDEEP

98304:TQbRA+IWO7uVWuDnu0VXcEKQfsUpvzx+2pgmnxyt/m:MA+i69DfB1KQfLpvzgmnxO/m

Score

10^/10

banload downloader dropper persistence privilege_escalation trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 52 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect.1\CLSID\ = "{20243201-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\VersionIndependentProgID\ = "NoteGem2024.Connect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\80cf65a80c75a5a31c280588d292888aebfe6a98a60a4a54d57b7f91562369ca.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\ = "IConnect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB50E645-261F-A1FC-7F29-D18688FCC5AE}\ = "PSFactoryBuffer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB50E645-261F-A1FC-7F29-D18688FCC5AE}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\ = "Note Gem 2024 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB50E645-261F-A1FC-7F29-D18688FCC5AE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect\CurVer\ = "NoteGem2024.Connect.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20243202-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\ = "Connect Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB50E645-261F-A1FC-7F29-D18688FCC5AE}\InProcServer32\ = "%systemroot%\\system32\\wininet.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB50E645-261F-A1FC-7F29-D18688FCC5AE}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect.1\ = "Connect Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20243202-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\ = "IConnect"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\AppID = "{20243201-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoteGem2024.Connect\CLSID\ = "{20243201-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\ProgID\ = "NoteGem2024.Connect.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20243202-AE2E-4A01-81A1-0F0BA89F8884}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\ = "{20243202-AE2E-4A01-81A1-0F0BA89F8884}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20243203-AE2E-4A01-81A1-0F0BA89F8884}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20243201-AE2E-4A01-81A1-0F0BA89F8884}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\80cf65a80c75a5a31c280588d292888aebfe6a98a60a4a54d57b7f91562369ca.dll"	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

regsvr32.exe

description pid process

Token: 33 1580 regsvr32.exe
Token: SeIncBasePriorityPrivilege 1580 regsvr32.exe

description	pid	process
Token: 33	1580	regsvr32.exe
Token: SeIncBasePriorityPrivilege	1580	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\80cf65a80c75a5a31c280588d292888aebfe6a98a60a4a54d57b7f91562369ca.dll
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-1-0x0000000003640000-0x000000000382A000-memory.dmp

Filesize
1.9MB

Download
memory/1580-10-0x0000000180000000-0x0000000180CBF000-memory.dmp

Filesize
12.7MB

Download
memory/1580-13-0x0000000180000000-0x0000000180CBF000-memory.dmp

Filesize
12.7MB

Download
memory/1580-14-0x0000000180000000-0x0000000180CBF000-memory.dmp

Filesize
12.7MB

Download
memory/1580-12-0x0000000180000000-0x0000000180CBF000-memory.dmp

Filesize
12.7MB

Download
memory/1580-16-0x0000000180000000-0x0000000180CBF000-memory.dmp

Filesize
12.7MB

Download

Analysis

Sharing