banload | 89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8f

Analysis

max time kernel
120s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
Size

2.2MB
MD5

02499a163b7d7ce0c75c02d6cf197270
SHA1

3c73a79f62848a7d351583f5c6efdb3126552e3d
SHA256

89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8f
SHA512

b01afc016f094d23551bf3e8c5e02874d3d7f56bf48f3bf960f4e56760c90f2098fd612f2c8fde0e004727bcb85cdefa23abf98171fcf35276d4179a58521b06
SSDEEP

49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEv3M:RF8QUitE4iLqaPWGnEv8

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe

Renames multiple (703) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\CompareUndo.tiff.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\AddUnblock.7z.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\Crashpad\settings.dat.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\AutoConvertTo	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Insertable	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TreatAs\ = "{64818D11-4F9B-11CF-86EA-00AA00B929E8}"	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\AutoConvertTo\ = "{64818D11-4F9B-11CF-86EA-00AA00B929E8}"	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Insertable\	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "PowerPoint.Slide.4"	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TreatAs	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2328	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
Token: SeIncBasePriorityPrivilege	2328	89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe

C:\Users\Admin\AppData\Local\Temp\89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe
"C:\Users\Admin\AppData\Local\Temp\89eef529153c95944a83b90eef7ead1489d9298a5acd2e37c98c5a9640657e8fN.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1045960512-3948844814-3059691613-1000\desktop.ini.tmp

Filesize
2.3MB

MD5
578437ddf93f0facf514659577f8c828

SHA1
3be99b3a198293a558ae4d096510feb21aeb5034

SHA256
904eb3180dbfb26ab7292144167e74173bffffb9b6c1a54e77529a796f5fb3ca

SHA512
23f1d67dc4bc8cb143f3f3bc828d18d7430c091b2863372462049669711859d6f0884f37b1ee8f6d84e7d2da39a0dc8b69b22af09dad016555050f7168188f92

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
2.4MB

MD5
1a2d374b020d2c88d84ed5019926f2f7

SHA1
a123ec0b795d72e4bad8cd2d6f5cf8c4d9876275

SHA256
ec95de6d0d2cbfa8e698dcd30ecba194c029093c08dd35e917fcec0b62891ae7

SHA512
045b5a84fdccc1bf2d996bca89192e4e53d633c2f6bfade3dff32aed79e09c741d83ab237a42b8dac9ea212d85353e7c53d4900e789d68faf062919cbaf9738f

Download Submit
memory/2328-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2328-2-0x00000000044A0000-0x00000000046AC000-memory.dmp

Filesize
2.0MB

Download
memory/2328-9-0x00000000044A0000-0x00000000046AC000-memory.dmp

Filesize
2.0MB

Download
memory/2328-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2328-13-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2328-14-0x00000000044A0000-0x00000000046AC000-memory.dmp

Filesize
2.0MB

Download
memory/2328-53-0x00000000044A0000-0x00000000046AC000-memory.dmp

Filesize
2.0MB

Download
memory/2328-52-0x00000000044A0000-0x00000000046AC000-memory.dmp

Filesize
2.0MB

Download
memory/2328-162-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2328-182-0x00000000044A0000-0x00000000046AC000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads