banload | 3eb1e11e6b8dfe05f3ba9e9cd05b48327dd88a2314a4fad03c30d1282d2974f9

Analysis

max time kernel
56s
max time network
63s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

#!NewFiile_7474_ṔḁṨṨCṏḌḙ$s/Setup.exe
Size

8.5MB
MD5

98169506fec94c2b12ba9930ad704515
SHA1

bce662a9fb94551f648ba2d7e29659957fd6a428
SHA256

9b8a5b0a45adf843e24214b46c285e44e73bc6eaf9e2a3b2c14a6d93ae541363
SHA512

7f4f7ac2326a1a8b7afc72822dae328753578eb0a4ffcec5adb4e4fb0c49703070f71e7411df221ee9f44d6b43a0a94921fe530877c5d5e71640b807e96def30
SSDEEP

196608:vdoUox8PFOegKz+qE1cnuyHgv3eZaOxqeXY4K:vC0O9m7EWEvbOxqetK

Score

10^/10

banload vidar 048d5e906358321b51376c6237a65c77 discovery downloader dropper evasion persistence privilege_escalation stealer trojan

Malware Config

Extracted

Family

vidar

Version

9.2

Botnet

048d5e906358321b51376c6237a65c77

https://redddog.xyz

https://steamcommunity.com/profiles/76561199677575543

https://t.me/snsb82

Attributes

profile_id_v2
048d5e906358321b51376c6237a65c77
user_agent
Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload

Detect Vidar Stealer 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2752-56-0x0000000000400000-0x0000000000B4B000-memory.dmp	family_vidar_v7
behavioral1/memory/2752-119-0x0000000000400000-0x0000000000B4B000-memory.dmp	family_vidar_v7
behavioral1/memory/2752-205-0x0000000000400000-0x0000000000B4B000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

Setup.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setup.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description	pid	Process	procid_target
PID 2320 set thread context of 2828	2320	Setup.exe	30

Loads dropped DLL 6 IoCs

Processes:

netsh.exeBvInputDiag.exeWerFault.exe

pid	Process
2828	netsh.exe
2752	BvInputDiag.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1652	2752	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

netsh.exeBvInputDiag.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BvInputDiag.exe

Modifies registry class 9 IoCs

Processes:

Setup.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\ = "ADOX.Index.6.0"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32\ = "%CommonProgramFiles%\\System\\ado\\msadox.dll"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\VersionIndependentProgID	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\VersionIndependentProgID\ = "ADOX.Index.6.0"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\InprocServer32\ThreadingModel = "Apartment"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\ProgID	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EEAF7AB-9B86-0A4B-E9E8-6422E70DF8B3}\ProgID\ = "ADOX.Index.6.0"	Setup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Setup.exenetsh.exe

pid	Process
2320	Setup.exe
2320	Setup.exe
2828	netsh.exe
2828	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Setup.exenetsh.exe

pid	Process
2320	Setup.exe
2828	netsh.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Setup.exenetsh.exeBvInputDiag.exe

description	pid	Process	procid_target
PID 2320 wrote to memory of 2828	2320	Setup.exe	30
PID 2320 wrote to memory of 2828	2320	Setup.exe	30
PID 2320 wrote to memory of 2828	2320	Setup.exe	30
PID 2320 wrote to memory of 2828	2320	Setup.exe	30
PID 2320 wrote to memory of 2828	2320	Setup.exe	30
PID 2828 wrote to memory of 2752	2828	netsh.exe	32
PID 2828 wrote to memory of 2752	2828	netsh.exe	32
PID 2828 wrote to memory of 2752	2828	netsh.exe	32
PID 2828 wrote to memory of 2752	2828	netsh.exe	32
PID 2828 wrote to memory of 2752	2828	netsh.exe	32
PID 2828 wrote to memory of 2752	2828	netsh.exe	32
PID 2752 wrote to memory of 1652	2752	BvInputDiag.exe	35
PID 2752 wrote to memory of 1652	2752	BvInputDiag.exe	35
PID 2752 wrote to memory of 1652	2752	BvInputDiag.exe	35
PID 2752 wrote to memory of 1652	2752	BvInputDiag.exe	35

C:\Users\Admin\AppData\Local\Temp\#!NewFiile_7474_ṔḁṨṨCṏḌḙ$s\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\#!NewFiile_7474_ṔḁṨṨCṏḌḙ$s\Setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\SysWOW64\netsh.exe
  2⤵
  - Loads dropped DLL
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe
    C:\Users\Admin\AppData\Local\Temp\BvInputDiag.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 1444
      4⤵
      Loads dropped DLL
      Program crash
      PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\26a42441

Filesize
6.0MB

MD5
714f7766875af3688755e2e61644f151

SHA1
17f9b04e60262516e1276a509a3cc057035151e6

SHA256
f0cf30aaa9b78653f2e19383a0020c45cb165c256ff6df217bf2031096096d59

SHA512
fec2140a799394ee75974687b730b0147ba3b788f0db2e6670f442479cab8dabacd84a4bb4ec8f1156f94445e92f5c0dd4765189fd2a9168c96b3e6f25e1edc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49CE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar49F1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\BvInputDiag.exe

Filesize
136KB

MD5
3d754cfa4a5b2a3f19720550acf6d3cf

SHA1
e5c78edbd54e14a42258a6c223d2cf128530e1b6

SHA256
8e5e627881c8182bfbb64601c6f4f7b30ba950dfd10f638f404479406b2c03b8

SHA512
18db06443a718b8233ac9724e7f96310bf5841d2c980cd1d02e6fb6743e23acc13bd67fcd214b4c0650ac933f6f081759d699c73e14baf26ffc324c2b30f153b

Download Submit
memory/2320-20-0x0000000004550000-0x000000000494A000-memory.dmp

Filesize
4.0MB

Download
memory/2320-13-0x0000000000400000-0x0000000001CF7000-memory.dmp

Filesize
25.0MB

Download
memory/2320-19-0x0000000000400000-0x0000000001CF7000-memory.dmp

Filesize
25.0MB

Download
memory/2320-15-0x0000000000400000-0x0000000001CF7000-memory.dmp

Filesize
25.0MB

Download
memory/2320-16-0x0000000000400000-0x0000000001CF7000-memory.dmp

Filesize
25.0MB

Download
memory/2320-22-0x000007FEF77C0000-0x000007FEF7918000-memory.dmp

Filesize
1.3MB

Download
memory/2320-36-0x000007FEF77D8000-0x000007FEF77D9000-memory.dmp

Filesize
4KB

Download
memory/2320-37-0x000007FEF77C0000-0x000007FEF7918000-memory.dmp

Filesize
1.3MB

Download
memory/2320-38-0x000007FEF77C0000-0x000007FEF7918000-memory.dmp

Filesize
1.3MB

Download
memory/2320-17-0x0000000000400000-0x0000000001CF7000-memory.dmp

Filesize
25.0MB

Download
memory/2320-14-0x0000000000400000-0x0000000001CF7000-memory.dmp

Filesize
25.0MB

Download
memory/2320-10-0x0000000000400000-0x0000000001CF7000-memory.dmp

Filesize
25.0MB

Download
memory/2320-0-0x0000000003D60000-0x0000000003F48000-memory.dmp

Filesize
1.9MB

Download
memory/2752-50-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2752-51-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2752-55-0x0000000076E90000-0x0000000077039000-memory.dmp

Filesize
1.7MB

Download
memory/2752-56-0x0000000000400000-0x0000000000B4B000-memory.dmp

Filesize
7.3MB

Download
memory/2752-119-0x0000000000400000-0x0000000000B4B000-memory.dmp

Filesize
7.3MB

Download
memory/2752-205-0x0000000000400000-0x0000000000B4B000-memory.dmp

Filesize
7.3MB

Download
memory/2828-45-0x0000000073180000-0x00000000732F4000-memory.dmp

Filesize
1.5MB

Download
memory/2828-52-0x0000000073180000-0x00000000732F4000-memory.dmp

Filesize
1.5MB

Download
memory/2828-43-0x0000000073180000-0x00000000732F4000-memory.dmp

Filesize
1.5MB

Download
memory/2828-53-0x000000007318E000-0x0000000073190000-memory.dmp

Filesize
8KB

Download
memory/2828-44-0x000000007318E000-0x0000000073190000-memory.dmp

Filesize
8KB

Download
memory/2828-41-0x0000000076E90000-0x0000000077039000-memory.dmp

Filesize
1.7MB

Download