banload | 7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925

General

Target

7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe
Size

3.9MB
MD5

1bece18acdaf3bab0a606daa2345dfda
SHA1

8f9a524255dd947882bca00afccba2ebb719b3ef
SHA256

7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925
SHA512

ca0d58566fb935b79a9ca932cbf7f226b3d81021eed9e135d632facc9f5593a8bd6410a95d1ebadf5758fc0567e2697a59e17a2bf5cce75da9aa7e97419a843f
SSDEEP

49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV8u/kUHHklZ77SFFXARrP/WH5f:RF8QUitE4iLqaPWGnEvS9EjyWHh

Score

10^/10

banload discovery downloader dropper evasion trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "OutlookAttachMoniker"	7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32	7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\OUTLRPC.DLL"	7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment"	7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2384	7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe
Token: SeIncBasePriorityPrivilege	2384	7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe

C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe
"C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

Filesize
4.0MB

MD5
1dcd73f5dbeedb19b737b22bedf61bf9

SHA1
38a8f49f3b7978980b8bf7b36de65f2e0d86d810

SHA256
61187afb26b85f8e59692c86d2032a5f36f272e9986b401c0a17ba160e59bbbc

SHA512
41ac5a4c4ab0ad435c2c045fbfb4ada4550038a2f935bc0138a3031581c132b4cff576a4b43198c2e8e11ab19fc9224374df6ac0cbef0f3d54573916d2c2c1e8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
4.0MB

MD5
6c0a27e7639eff75a7e3532ef9787cc2

SHA1
cccb3d219a1522d59c3b4bec6b882d26350f2192

SHA256
a7f83305043b41ceb1c958018c41bab151c6b2ce7ee3e37276101e0366f40af3

SHA512
3637f24d274a0b5ed09ce8e5f0f808126504ef18848432f641940a30cabbfb834487cb0f6969ef0bcdceef16faa290406a2c6c2b1d9c812ddc05d34fba0d6ff6

Download Submit
memory/2384-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2384-1-0x0000000003180000-0x000000000338C000-memory.dmp

Filesize
2.0MB

Download
memory/2384-8-0x0000000003180000-0x000000000338C000-memory.dmp

Filesize
2.0MB

Download
memory/2384-11-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2384-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2384-13-0x0000000003180000-0x000000000338C000-memory.dmp

Filesize
2.0MB

Download
memory/2384-23-0x0000000003180000-0x000000000338C000-memory.dmp

Filesize
2.0MB

Download
memory/2384-29-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2384-31-0x0000000003180000-0x000000000338C000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads