banload | 31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
Size

3.4MB
MD5

e7187962611d1ba8a19da99000f18a80
SHA1

7b351fb880ff5af34379d8cd910816d8450d5b79
SHA256

31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046
SHA512

57ba7dbdc1bc8951f0d379c8890d2acf8a9081c903aee3ddf9250c45712e9956b9ff586818e543dd6e704bcffeb555d7ff4ae4286d9043cbe38f4a46014eb3c2
SSDEEP

49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV8u/kUHHklZ77SFm:RF8QUitE4iLqaPWGnEvS9Ejc

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe

Renames multiple (207) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Apartment"	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Installed Apps Enumerator"	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\appwiz.cpl"	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2256	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
Token: SeIncBasePriorityPrivilege	2256	31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe

C:\Users\Admin\AppData\Local\Temp\31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe
"C:\Users\Admin\AppData\Local\Temp\31e8aebedd14e68d31200daeaf55e7f64ce0b457794e78c20153a51cac0ba046N.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini.tmp

Filesize
3.5MB

MD5
1b7cd523363fd5ff3c0410613bcdcd9b

SHA1
42ac5a3eb4fc1db7c74293af3d57a7868575cc91

SHA256
658ed92c1c417a9b79248a85654c5756079039620850cd467e8caafedb60c893

SHA512
5022af1331e16e45ec8cdac82c9ca25f2a6a7bd31bb5a0ee3a28f87e43da5d34c112faf8753ffe6ae43bfba5988041e2e09cac58486098fb3120e4569c0dfc31

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
3.5MB

MD5
a4cd8f4e7d2d4c94437c40bc9f88d49a

SHA1
8f54d5d98daf1df261f203e49b5b984658bdf018

SHA256
e21cf8fdf93a7ab2b358ddf3983de43a3820871790e776eee74de1738e1f4a7f

SHA512
c188d58a2817e291ff41aeed160bb680f2b5f536348767125dde836580107f1b0739e310f246485ad076ae0d5dfaef9a30524934e6cfc30bdd67442a7048cc0b

Download Submit
memory/2256-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2256-1-0x00000000030B0000-0x00000000032BC000-memory.dmp

Filesize
2.0MB

Download
memory/2256-7-0x00000000030B0000-0x00000000032BC000-memory.dmp

Filesize
2.0MB

Download
memory/2256-11-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2256-10-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2256-12-0x00000000030B0000-0x00000000032BC000-memory.dmp

Filesize
2.0MB

Download
memory/2256-24-0x00000000030B0000-0x00000000032BC000-memory.dmp

Filesize
2.0MB

Download
memory/2256-40-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2256-46-0x00000000030B0000-0x00000000032BC000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads