banload | 0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2025 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
Size

3.7MB
MD5

db358bf02b161dfe254dbf9e993fce8f
SHA1

140ee2d9e67a82ac072766c0fefeac5ddf94d326
SHA256

0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7
SHA512

55fb0a70b4f111458c23e9ddf473f9657831083d2f78a181f710f602cb15fdf8b833d7afb653c3c3da40097614c80a5ed41cfbb41b410a0dca9c98a17f1e69b0
SSDEEP

98304:RF8QUitE4iLqaPWGnEvK7RkOEEo+A7mOk3oC:RFQWEPnPBnEXm

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe

Renames multiple (420) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwritalm.dat.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Both"	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "TCImeComponentMgr"	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\IME\\IMETC\\IMTCCFG.DLL"	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4440	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
Token: SeIncBasePriorityPrivilege	4440	0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe

C:\Users\Admin\AppData\Local\Temp\0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe
"C:\Users\Admin\AppData\Local\Temp\0d37a9ad99ad4573ae16ff449544b4c6727bfbb2814b801bce7017aac4a922f7.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

Filesize
3.9MB

MD5
65c43286cb80025e966ae33e64d770e7

SHA1
e6e479c8c9318a7a5eeec44304925d0b26c22a9a

SHA256
06921f4707fcc26f33310c69e424197b095d567afd839d0abeaec0c3439bd7da

SHA512
fe8ef73d8df9b438f2f20911be11515c30dd8678b6c6eeac38b0b50a642a3f55a1d51c6621e46f6fe1902849ec2e4dd510ffa53c2cf99cfdadfa61af63a5a6ad

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
4.0MB

MD5
b918554a46bc97e3b8620aac0f261074

SHA1
18ee172d8ed8bb66c8a804c497fdf751d7598b31

SHA256
5fb3e5922a8b14ffbbc8f4361940991f1886e4bc8d36cb9cdb3306ec128a398a

SHA512
e3925e47168ec6980b46780baba91aa32e10b999fbfd8064ac21c90776520a10dd9dfa9a8388021b440595c062342f2ef2723f23461e116fca59a4bb21dcab7c

Download Submit
memory/4440-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4440-2-0x0000000004900000-0x0000000004B0C000-memory.dmp

Filesize
2.0MB

Download
memory/4440-9-0x0000000004900000-0x0000000004B0C000-memory.dmp

Filesize
2.0MB

Download
memory/4440-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4440-13-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4440-14-0x0000000004900000-0x0000000004B0C000-memory.dmp

Filesize
2.0MB

Download
memory/4440-42-0x0000000004900000-0x0000000004B0C000-memory.dmp

Filesize
2.0MB

Download
memory/4440-43-0x0000000004900000-0x0000000004B0C000-memory.dmp

Filesize
2.0MB

Download
memory/4440-116-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4440-132-0x0000000004900000-0x0000000004B0C000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads