banload | b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527

General

Target

b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Size

2.3MB
MD5

bd9b72f660b79a80de71fc6f94d534da
SHA1

4aeefc689746c604ca11dfcb940b60defebed13a
SHA256

b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527
SHA512

6c731e30972c33e30b1a92620e4223c8636b3127784a5903f0cc113a680ea859b59ab7dae870d79bdc461af9eea933bd6dac713e6cd519f9ce54885d44bf46ba
SSDEEP

49152:VOIq2/OmUiBTn1Kv3Q/Jos68B1ECYJgk4lN0saAmZea+:VOh22mX1s3Q/JN68B+5J8N0XAmZeR

Score

10^/10

banload discovery downloader dropper trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\LocalServer32\ = "\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /Automation"	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\VersionIndependentProgID	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\ = "Microsoft Word Application"	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InprocServer32\RuntimeVersion = "v2.0.50727"	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InprocServer32\15.0.0.0\Assembly = "Microsoft.Office.Interop.Word, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InprocServer32\15.0.0.0\RuntimeVersion = "v2.0.50727"	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\VersionIndependentProgID\ = "Word.Application"	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InprocHandler32	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InprocServer32\Assembly = "Microsoft.Office.Interop.Word, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InprocServer32\15.0.0.0\Class = "Microsoft.Office.Interop.Word.ApplicationClass"	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\ProgID\ = "Word.Application.16"	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InprocHandler32\ = "ole32.dll"	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InprocServer32	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InprocServer32\Class = "Microsoft.Office.Interop.Word.ApplicationClass"	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InprocServer32\15.0.0.0	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\LocalServer32	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\ProgID	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3856	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
Token: SeIncBasePriorityPrivilege	3856	b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe

C:\Users\Admin\AppData\Local\Temp\b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe
"C:\Users\Admin\AppData\Local\Temp\b6eea315f5a7fab7873e443e1220e3e270b090fae13bf4695c11888647125527.exe"
1⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3856-0-0x0000000000400000-0x00000000006F2000-memory.dmp

Filesize
2.9MB

Download
memory/3856-2-0x0000000002910000-0x0000000002B11000-memory.dmp

Filesize
2.0MB

Download
memory/3856-8-0x0000000002910000-0x0000000002B11000-memory.dmp

Filesize
2.0MB

Download
memory/3856-13-0x0000000000400000-0x00000000006F2000-memory.dmp

Filesize
2.9MB

Download
memory/3856-18-0x0000000002910000-0x0000000002B11000-memory.dmp

Filesize
2.0MB

Download
memory/3856-17-0x0000000000400000-0x00000000006F2000-memory.dmp

Filesize
2.9MB

Download
memory/3856-16-0x0000000000400000-0x00000000006F2000-memory.dmp

Filesize
2.9MB

Download
memory/3856-14-0x0000000000400000-0x00000000006F2000-memory.dmp

Filesize
2.9MB

Download
memory/3856-15-0x0000000000400000-0x00000000006F2000-memory.dmp

Filesize
2.9MB

Download
memory/3856-20-0x0000000002910000-0x0000000002B11000-memory.dmp

Filesize
2.0MB

Download
memory/3856-22-0x0000000000400000-0x00000000006F2000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing