banload | 3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1

Analysis

max time kernel
61s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
Size

2.2MB
MD5

664c1e089f7daabb50b054040b60ac8f
SHA1

d0fbf03fbc8c0a1209ff31ec522bf120d033f8d7
SHA256

3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1
SHA512

cb7c26bf43f1452123eaf3f1e5ad9ae7f35810d5305ba270389822c0a8f726bf0c7e330f11a88860d5917c8faf5d3307ea6e834a66373f21d632973811e49a16
SSDEEP

49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEv30:RF8QUitE4iLqaPWGnEvk

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe

Renames multiple (249) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "HandWritingSkinProps Class"	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%CommonProgramFiles%\\microsoft shared\\ink\\tipskins.dll"	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment"	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4328	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
Token: SeIncBasePriorityPrivilege	4328	3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe

C:\Users\Admin\AppData\Local\Temp\3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe
"C:\Users\Admin\AppData\Local\Temp\3147cdf214d6ea10f730524989e5179c7e6299bd2bdc60cd4c651b0a10d98ae1.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini.tmp

Filesize
2.3MB

MD5
7960f30dc4cb86737dfd69c678bb196f

SHA1
526a40fdd11c43b50dee302d30604406660b303a

SHA256
d967e1ad8a393020c9b1ca33feaf8da2a32e88745d12461804fd54cc5be032cc

SHA512
11c7a6a24418208d4d66499f864e766a479bb80c5bdb9d27a3c73d5a628f7f2df5b0ff5705369670e201f9bae985fb0ba42dc3e047d1c40fd9be462a831941c3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
2.4MB

MD5
c07f1af242df3f08bdc878450aa64642

SHA1
e80d35ac6540be9bf1c9b7e099f4ef05eda5a6c2

SHA256
892053378b418df08fe79857c35969657ab391c0a73abb548124d7c60604aa0d

SHA512
d911b01eab9a1ed72edb86124adb0499858be635bf2cf96def6c7199c95de606350b2c13f6f2912981115e345e5b2237e86c9aa61da966e80a857d8a69d3147a

Download Submit
memory/4328-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4328-2-0x0000000004980000-0x0000000004B8C000-memory.dmp

Filesize
2.0MB

Download
memory/4328-9-0x0000000004980000-0x0000000004B8C000-memory.dmp

Filesize
2.0MB

Download
memory/4328-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4328-13-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4328-14-0x0000000004980000-0x0000000004B8C000-memory.dmp

Filesize
2.0MB

Download
memory/4328-58-0x0000000004980000-0x0000000004B8C000-memory.dmp

Filesize
2.0MB

Download
memory/4328-59-0x0000000004980000-0x0000000004B8C000-memory.dmp

Filesize
2.0MB

Download
memory/4328-170-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4328-192-0x0000000004980000-0x0000000004B8C000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads