banload | feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
Size

3.0MB
MD5

f66bd304ccdd3a52ab75ac80ceffbd50
SHA1

357c988948b13361b7236212ebdc0dbdab6caf30
SHA256

feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07
SHA512

47d02ee8a713491f6f945557e2fb012957a107f788732f9eb1737cd7653ff24b47d7c32f737da0d2b46963adcbb9e6aeecb22fa7435c7eef16bb890d52e0f931
SSDEEP

49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV47RIgiBud:RF8QUitE4iLqaPWGnEvK7RR

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe

Renames multiple (211) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe

Drops file in Program Files directory 64 IoCs

Processes:

feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe

Modifies registry class 5 IoCs

Processes:

feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Microsoft Multiple AutoComplete List Container"	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shell32.dll"	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Apartment"	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe

description	pid	Process
Token: 33	2092	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
Token: SeIncBasePriorityPrivilege	2092	feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe

C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
"C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
3.1MB

MD5
c5b5aad25c8751ce694e26cc32989665

SHA1
daaf3999992bc9a0f7f04eda661365a1e4674d7d

SHA256
6888e471b1f0ace15bfc5c982fa83c8c71085c3c965a67960c3358b4554973fc

SHA512
4ba0750ed3079922f1d25f732a323f150cf7acdaf58d195a5a298fc580ee90120e9d4a19ae869c04b027b0c16ba8c2fd57f46d6d96fa5b92750335e59c5fe859

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
3.1MB

MD5
8e84d40c786fea9b3e0200333f2798cd

SHA1
7a64915c3c6f72d8be0bd2b0528edd4052b2aa01

SHA256
4b31cf28551ae5756e302611253dfb433cb6279ebbfb3fed638c0bf3b35b2c87

SHA512
28d9c989cb126c0a7ac009d24ed0b62108fd998886e5aade153cf031486916353ddf5f79020b90c6d41948c18c1f22686cb12951729d3f78f29d8b68531bb264

Download Submit
memory/2092-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2092-1-0x0000000003040000-0x000000000324C000-memory.dmp

Filesize
2.0MB

Download
memory/2092-8-0x0000000003040000-0x000000000324C000-memory.dmp

Filesize
2.0MB

Download
memory/2092-11-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2092-13-0x0000000003040000-0x000000000324C000-memory.dmp

Filesize
2.0MB

Download
memory/2092-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2092-26-0x0000000003040000-0x000000000324C000-memory.dmp

Filesize
2.0MB

Download
memory/2092-25-0x0000000003040000-0x000000000324C000-memory.dmp

Filesize
2.0MB

Download
memory/2092-43-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2092-53-0x0000000003040000-0x000000000324C000-memory.dmp

Filesize
2.0MB

Download