banload | 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2025 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
Size

2.6MB
MD5

f75a6d32a2b1ffdb5c64936e919060e0
SHA1

03013bfeffb93f77a873b24fd860fdca7fc030ff
SHA256

185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297
SHA512

c864ffdc63d713b28cdadb59908b970a100916a39fd2a05dacb8500afe4f14675c4a91535626b4d3fc299d14971261ee7c24ca9f7524c62ebdfcfa8b5a992d99
SSDEEP

49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVzYBJIUu:RF8QUitE4iLqaPWGnEvL

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe

Renames multiple (632) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Search Protocol URL Generator"	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\Windows.Storage.Search.dll"	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Apartment"	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4440	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
Token: SeIncBasePriorityPrivilege	4440	185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe

C:\Users\Admin\AppData\Local\Temp\185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
"C:\Users\Admin\AppData\Local\Temp\185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

Filesize
2.7MB

MD5
91753f3f0cbad8bce894fa2484d6fb79

SHA1
25334b77b373fd0b34d9ffef57b3b6a6432c75d0

SHA256
4d6e979357b20759b655df74a2156695a8f990f39611672ae91345bf31b1a566

SHA512
119d49c790a5d118b1bb56eaceff5589758fb6519d2fb9d79d8235e73285b19661e8d211c9601ce9c9e5fd821974b24146e5b6c2ed21b5ab152d91ed63749e5f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
2.8MB

MD5
a816730e3229e97c4faaf072979846ce

SHA1
2e80cf50a178c60c6da20f2895d5a58dbff2881f

SHA256
d54d5082bb0d5be1ce3d8a21570c99f99e4d40a9b2391dd08ec4fe02144a021c

SHA512
b8220aea9c71c115f3503bf9e6217d36d8a708421b14439e2f4d934b4b01d2721ce48b04b23169328394bb4cb88f8e9b7c4e94cc75c01b4567f958b170de1914

Download Submit
memory/4440-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4440-2-0x00000000049E0000-0x0000000004BEC000-memory.dmp

Filesize
2.0MB

Download
memory/4440-9-0x00000000049E0000-0x0000000004BEC000-memory.dmp

Filesize
2.0MB

Download
memory/4440-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4440-13-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4440-14-0x00000000049E0000-0x0000000004BEC000-memory.dmp

Filesize
2.0MB

Download
memory/4440-49-0x00000000049E0000-0x0000000004BEC000-memory.dmp

Filesize
2.0MB

Download
memory/4440-48-0x00000000049E0000-0x0000000004BEC000-memory.dmp

Filesize
2.0MB

Download
memory/4440-148-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4440-170-0x00000000049E0000-0x0000000004BEC000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads