banload | 405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241

General

Target

405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Size

2.2MB
MD5

f89556f1d87f28f53330cbe3a3f69599
SHA1

2a0400ac75547e32aba93b330ed91456edeeaae0
SHA256

405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241
SHA512

25bb3d0100f9fe871ba47c283c4bb6652290d2e9263aa9456045de242f10b73f19f59928761a18527a103f463d3c846c3ebce767c4644e538aa34764a9838a6b
SSDEEP

49152:RpbRm4GPK/MbeGTEaRuvRIQ15PNOWoVDn99c1/0VXTa9zAmZea+:H1GS/lvLxNfuDnu0VXTahAmZeR

Score

10^/10

banload downloader dropper persistence privilege_escalation trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 16 IoCs

Processes:

405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\Version\ = "1.0"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InprocServer32\ = "%SystemRoot%\\System32\\pla.dll"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InprocServer32\ThreadingModel = "both"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\ProgID	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\TypeLib	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\AppID = "{03837503-098b-11d8-9414-505054503030}"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\LocalServer32	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\LocalServer32\ = "%SystemRoot%\\system32\\plasrv.exe"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\Version	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\VersionIndependentProgID\ = "PLA.BootTraceSessionCollection"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\ = "BootTraceSessionCollection"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InprocServer32	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\ProgID\ = "PLA.BootTraceSessionCollection.1"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\TypeLib\ = "{03837500-098B-11D8-9414-505054503030}"	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\VersionIndependentProgID	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe

description	pid	Process
Token: 33	3012	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
Token: SeIncBasePriorityPrivilege	3012	405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe

C:\Users\Admin\AppData\Local\Temp\405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe
"C:\Users\Admin\AppData\Local\Temp\405c145a686ef98dcca9daf9e039c63d077f819111c062cf30f71e99d7ccb241.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-0-0x0000000002740000-0x000000000292A000-memory.dmp

Filesize
1.9MB

Download
memory/3012-7-0x0000000002740000-0x000000000292A000-memory.dmp

Filesize
1.9MB

Download
memory/3012-12-0x0000000140000000-0x00000001402C8000-memory.dmp

Filesize
2.8MB

Download
memory/3012-13-0x0000000140000000-0x00000001402C8000-memory.dmp

Filesize
2.8MB

Download
memory/3012-14-0x0000000002740000-0x000000000292A000-memory.dmp

Filesize
1.9MB

Download
memory/3012-16-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download
memory/3012-17-0x0000000002740000-0x000000000292A000-memory.dmp

Filesize
1.9MB

Download
memory/3012-19-0x0000000140000000-0x00000001402C8000-memory.dmp

Filesize
2.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads