banload | 79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d

General

Target

79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe
Size

9.9MB
MD5

e9957fce6989f2e51fe69394ec77b129
SHA1

1cec361fad65c3c9dbf5ce3aeb95cd6d8c629255
SHA256

79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d
SHA512

defccb06b8ccf6b29bf81a85913ef1880a0e668a334977a9967cb2db25205ff6db9c02d2de4be55705b564009aedea63c39f2fecf9ff4cab9daacb9b395c7557
SSDEEP

196608:RFQWEPnPBnEmOKIbGdCzNA7rlvRz1rrFBV6tpjuj6gYPKHCKsi:PEPnPBnbOedjUtYj6gYPYP

Score

10^/10

banload discovery downloader dropper evasion trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "ADOX.User.6.0"	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "ADOX.User.6.0"	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%CommonProgramFiles%\\System\\ado\\msadox.dll"	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment"	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "ADOX.User.6.0"	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1256	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe
Token: SeIncBasePriorityPrivilege	1256	79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe

C:\Users\Admin\AppData\Local\Temp\79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe
"C:\Users\Admin\AppData\Local\Temp\79703b07bfc8ca14a2b170305685558c6037f558443e6080124388d3cf38819d.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

Filesize
10.0MB

MD5
5ebace0ab0100663a6ae00d9249d6785

SHA1
4635438a37263967d118abcdec6300b39d69e67a

SHA256
ca9c52b0b5a15f018501a854ddb5059da4086e2ef23b44801445476cd0cb42cf

SHA512
e13f4fbdbe2a07416d714a0d564a84ddc616be429f8ee50161aa7f8456794306dbdc112d0f54df73f1e5d551733bcd15c94165ab9a0bbd2995b044f6d89b9c4e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
10.0MB

MD5
ce40dc3cacc226fb880933496449afdf

SHA1
6d20d230e2e999a7a1c137e78351792765967381

SHA256
4597fb86b24c25cc5714b6919a00f76a12d922054fdd40f252267a90c2d13916

SHA512
7db34b8d0aba5f260e4c05a576a0b4bea0c9ae23f64b1cfab4068a99946da67a8f6630676127cdef1aa542b62a30c551e68661f65965ad3a254890b4f0ef1ccd

Download Submit
memory/1256-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/1256-1-0x0000000003090000-0x000000000329C000-memory.dmp

Filesize
2.0MB

Download
memory/1256-8-0x0000000003090000-0x000000000329C000-memory.dmp

Filesize
2.0MB

Download
memory/1256-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/1256-11-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/1256-13-0x0000000003090000-0x000000000329C000-memory.dmp

Filesize
2.0MB

Download
memory/1256-17-0x0000000003090000-0x000000000329C000-memory.dmp

Filesize
2.0MB

Download
memory/1256-25-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/1256-27-0x0000000003090000-0x000000000329C000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads