banload | 8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41

Analysis

max time kernel
60s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2024 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
Size

4.0MB
MD5

70713908aec9c29229f4788ca59a3c4b
SHA1

aa7787907294ba39e014a17b2d243d9c8f5ab95e
SHA256

8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41
SHA512

247972561c472be3a910b23f741bee876f330b5bb48df6dbd85b092a3e5631747d33c01eac83fefe3d93d81e41b6c1e3d3db6f97474a34f848d4b9b267e3a2aa
SSDEEP

98304:RF8QUitE4iLqaPWGnEvK7RkOEEo+A7mOk+I:RFQWEPnPBnEXxI

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe

Renames multiple (219) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment"	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "FormHost.FormHost"	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "FormHost Class"	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%SystemRoot%\\SysWow64\\mmcndmgr.dll"	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "FormHost.FormHost.1"	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4244	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
Token: SeIncBasePriorityPrivilege	4244	8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe

C:\Users\Admin\AppData\Local\Temp\8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe
"C:\Users\Admin\AppData\Local\Temp\8aa50f7938c30c4fe342eda08f87ab836c47a9812eb939e765fae3be39d4bc41.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

Filesize
4.2MB

MD5
3a27eda7071e164e9fd143d10c77f9bf

SHA1
02166a78baa9f73278033d120dceacbdb765db5e

SHA256
fa2155259e606a3c34da8fb58f8c4ee6a1984fed84ee9d3f65581ff99db41fce

SHA512
58f7d472792421f39d9facc72d1afcd24bbcacb2264d2f540da7b81f3a00120b2182df2d80d6a8958c93f9cacc0aa119078aaf371d91efa4c3ae3a76abc778bb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
4.3MB

MD5
92ee50338ca406a40d69019a28dd6bf5

SHA1
43f9ef413229e37d89cac3ba872b8b985866da34

SHA256
b67e23a9768e6768ff5c2e3d27008478818c880060b4bc4f462142f95e42a97b

SHA512
14a76ebbd947b1e5ff9d201f41268a843a956d610adff916046f701ce9887f5c35dab63f309a5fd5a1ec85898dee4f0db5f34f709b3249fb669e878e5d627a18

Download Submit
memory/4244-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4244-2-0x0000000004A00000-0x0000000004C0C000-memory.dmp

Filesize
2.0MB

Download
memory/4244-9-0x0000000004A00000-0x0000000004C0C000-memory.dmp

Filesize
2.0MB

Download
memory/4244-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4244-13-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4244-14-0x0000000004A00000-0x0000000004C0C000-memory.dmp

Filesize
2.0MB

Download
memory/4244-42-0x0000000004A00000-0x0000000004C0C000-memory.dmp

Filesize
2.0MB

Download
memory/4244-43-0x0000000004A00000-0x0000000004C0C000-memory.dmp

Filesize
2.0MB

Download
memory/4244-112-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4244-124-0x0000000004A00000-0x0000000004C0C000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads