banload | 871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3

Analysis

max time kernel
60s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
Size

3.0MB
MD5

acec99a04190e0983df5d2348bedb173
SHA1

0e3f4d2ede8d1861048db044edccdf44b728da37
SHA256

871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3
SHA512

1bfc447a5cc10f9e46c4c65c38307ff10a8ad72f48fa4bbd091102c8b987f276f49241b7c5d98298a76ae436901d2111be90593cf844ca823f7d8314d24dbf00
SSDEEP

49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV8u/kUHHkNJIyJ:RF8QUitE4iLqaPWGnEvS9EwIyJ

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe

Renames multiple (221) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwresplm.dat.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "PSFactoryBuffer"	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%systemroot%\\SysWow64\\comuid.dll"	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Both"	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1268	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
Token: SeIncBasePriorityPrivilege	1268	871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe

C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe
"C:\Users\Admin\AppData\Local\Temp\871801352c3007a3b7e6bbee8b6d14617ef224ef6cd4cdc4c9129bfe076be2a3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp

Filesize
3.1MB

MD5
55af2091c4e879d72b7052d0e10c6427

SHA1
081342155e671cedbb7b6081bfe4ba658234d0a6

SHA256
500010a2d0dc5ca987977f5b4d7d8dcf4cdcb9b5f16edd4559c0cd2de6da09f8

SHA512
0a808100bb91df219fd833387dc6b1f35ed46b7c61ff7f3d45ad7b3fe09799aed73043a81ac842a7060d78dcabea6fe4fec10d7abd49702194b4c2d8286bf0b2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
3.2MB

MD5
d7df79ebf8f97e7347105311751b8651

SHA1
4424f8bb04029245038c66482ed258ac5c7f6caf

SHA256
d63f1d70b691ad332fc5d774f4700d6a97edab71da66370d2ac67d3bd0dbd0d1

SHA512
d80c7a5d9c468044a9b93dd654629782e826899b712a06026ca37268d811eabff235d7e3ced011cc5b7b8b26601ac036221a2bcbdba9811706c1bca23d330fae

Download Submit
memory/1268-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/1268-2-0x0000000004960000-0x0000000004B6C000-memory.dmp

Filesize
2.0MB

Download
memory/1268-9-0x0000000004960000-0x0000000004B6C000-memory.dmp

Filesize
2.0MB

Download
memory/1268-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/1268-13-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/1268-14-0x0000000004960000-0x0000000004B6C000-memory.dmp

Filesize
2.0MB

Download
memory/1268-49-0x0000000004960000-0x0000000004B6C000-memory.dmp

Filesize
2.0MB

Download
memory/1268-48-0x0000000004960000-0x0000000004B6C000-memory.dmp

Filesize
2.0MB

Download
memory/1268-134-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/1268-152-0x0000000004960000-0x0000000004B6C000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads