banload | bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2025 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
Size

3.7MB
MD5

bb2e183b52db0d0b2227933d528939f0
SHA1

462af6192119775aa49bffe64d0e7bb25899bb11
SHA256

bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153
SHA512

95dbd8fb856a0dfbd3d77adc7b7e9e890cc85700bbf5aa3187a65bb2032d35831310069d4753aaca8d523e06e21a686eb344908f5651c4cffe4dcd898166294b
SSDEEP

98304:RF8QUitE4iLqaPWGnEvK7RkOEEo+A7mOk3oS:RFQWEPnPBnEX2

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe

Renames multiple (381) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\dotnet\LICENSE.txt.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Class = "Microsoft.Office.Interop.Excel.WorkbookClass"	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\RuntimeVersion = "v2.0.50727"	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\15.0.0.0\RuntimeVersion = "v2.0.50727"	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\15.0.0.0\Class = "Microsoft.Office.Interop.Excel.WorkbookClass"	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Assembly = "Microsoft.Office.Interop.Excel, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\15.0.0.0	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\15.0.0.0\Assembly = "Microsoft.Office.Interop.Excel, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4216	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
Token: SeIncBasePriorityPrivilege	4216	bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe

C:\Users\Admin\AppData\Local\Temp\bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe
"C:\Users\Admin\AppData\Local\Temp\bc6876b82828ba27684e93ae38e6d84148f0a384de8a654daf9e66aabeca9153N.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp

Filesize
3.9MB

MD5
63971b476d90e74611a46a7b513e6daf

SHA1
580a9fac2a2544a738dfad0a608a47b3aec433d5

SHA256
fa5a85dc9936944d3b9b56c6f8833b197f6f40cefe7414c261135b93743b3670

SHA512
324f9eba2f1bba8995ffc3586e3a1deaf0b4b7b1814d78aca2a92372a6f47111981d7fd306efa523683d20039e4f91ba70d654dc6d9ba8ee379d6743fa940e42

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
4.0MB

MD5
03a9b035821cc5390de3df9ca87429cc

SHA1
9c0c12a0899fd220f179ee69ea0725fe31069328

SHA256
6a38faaaae707e8fc23d55df8f7a81fcb976151652f661486f8643e880bd33ba

SHA512
5c4f269d9fa439cc9399e79677b54b0a5730e38f5de7d49ea812fc41a6e80d8f244af8f8425665accf779935a91d42f9e8135ff94d28cbce62d8ce5bcdc0a594

Download Submit
memory/4216-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4216-2-0x0000000004990000-0x0000000004B9C000-memory.dmp

Filesize
2.0MB

Download
memory/4216-9-0x0000000004990000-0x0000000004B9C000-memory.dmp

Filesize
2.0MB

Download
memory/4216-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4216-13-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4216-14-0x0000000004990000-0x0000000004B9C000-memory.dmp

Filesize
2.0MB

Download
memory/4216-40-0x0000000004990000-0x0000000004B9C000-memory.dmp

Filesize
2.0MB

Download
memory/4216-41-0x0000000004990000-0x0000000004B9C000-memory.dmp

Filesize
2.0MB

Download
memory/4216-106-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/4216-120-0x0000000004990000-0x0000000004B9C000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads