banload | 405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241

General

Target

405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Size

2.2MB
MD5

f89556f1d87f28f53330cbe3a3f69599
SHA1

2a0400ac75547e32aba93b330ed91456edeeaae0
SHA256

405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241
SHA512

25bb3d0100f9fe871ba47c283c4bb6652290d2e9263aa9456045de242f10b73f19f59928761a18527a103f463d3c846c3ebce767c4644e538aa34764a9838a6b
SSDEEP

49152:RpbRm4GPK/MbeGTEaRuvRIQ15PNOWoVDn99c1/0VXTa9zAmZea+:H1GS/lvLxNfuDnu0VXTahAmZeR

Score

10^/10

banload downloader dropper persistence privilege_escalation trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 13 IoCs

Processes:

405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\Version	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\Version\ = "3.0"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\ = "SAX XML Reader"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InProcServer32\ThreadingModel = "Both"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InProcServer32\ = "%SystemRoot%\\System32\\msxml3.dll"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\ProgID	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\ProgID\ = "Msxml2.SAXXMLReader"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\TypeLib	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\VersionIndependentProgID\ = "Msxml2.SAXXMLReader"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InProcServer32	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\TypeLib\ = "{F5078F18-C551-11D3-89B9-0000F81FE221}"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\VersionIndependentProgID	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe

description	pid	Process
Token: 33	2364	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Token: SeIncBasePriorityPrivilege	2364	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe

C:\Users\Admin\AppData\Local\Temp\405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
"C:\Users\Admin\AppData\Local\Temp\405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2364-0-0x00000000023C0000-0x00000000025AA000-memory.dmp

Filesize
1.9MB

Download
memory/2364-7-0x00000000023C0000-0x00000000025AA000-memory.dmp

Filesize
1.9MB

Download
memory/2364-13-0x0000000140000000-0x00000001402C8000-memory.dmp

Filesize
2.8MB

Download
memory/2364-14-0x00000000023C0000-0x00000000025AA000-memory.dmp

Filesize
1.9MB

Download
memory/2364-16-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2364-12-0x0000000140000000-0x00000001402C8000-memory.dmp

Filesize
2.8MB

Download
memory/2364-17-0x00000000023C0000-0x00000000025AA000-memory.dmp

Filesize
1.9MB

Download
memory/2364-19-0x0000000140000000-0x00000001402C8000-memory.dmp

Filesize
2.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads