banload | c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1

General

Target

c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
Size

2.2MB
MD5

95acf5ebbc118aa4fbcfe3d7d0073696
SHA1

ddd76bf5acdfd196406c0ce5676331192a4e9362
SHA256

c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1
SHA512

86fa39dbddec7bc3fa80141e4be69675f787743153eaa7337a2801486e1d01042a0bb752c5c2d643fec8bf75ae449157844e122089ff53fe8e171b13cf684594
SSDEEP

49152:dpbRm4GPK/MreGTEpqzCZzD0TYkYoVDn99c1/0VXtj0HAmZea+:z1GS/2z28YbuDnu0VXtjyAmZeR

Score

10^/10

banload downloader dropper persistence privilege_escalation trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\ = "Virtual Factory for DiagCpl"	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\LocalizedString = "@%SystemRoot%\\System32\\DiagCpl.dll,-1"	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\Elevation	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\Elevation\Enabled = "1"	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InProcServer32	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InProcServer32\ = "%SystemRoot%\\System32\\shpafact.dll"	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\VirtualServerObjects	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\AppId = "{12C21EA7-2EB8-4B55-9249-AC243DA8C666}"	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\Elevation\IconReference = "@%Systemroot%\\System32\\DiagCpl.dll,-1"	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\InProcServer32\ThreadingModel = "Apartment"	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD032C9B-8F11-E980-1181-CF9942277AA0}\VirtualServerObjects\{d0b7e02c-e1a3-11dc-81ff-001185ae5e76}	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2604	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
Token: SeIncBasePriorityPrivilege	2604	c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe

C:\Users\Admin\AppData\Local\Temp\c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe
"C:\Users\Admin\AppData\Local\Temp\c4bdbd7738a494010351a8bafd2e1444f50dccb1f2eacf2d1e5bae38b514b8c1.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2604-7-0x0000000002430000-0x000000000261A000-memory.dmp

Filesize
1.9MB

Download
memory/2604-0-0x0000000002430000-0x000000000261A000-memory.dmp

Filesize
1.9MB

Download
memory/2604-13-0x0000000140000000-0x00000001402C8000-memory.dmp

Filesize
2.8MB

Download
memory/2604-14-0x0000000002430000-0x000000000261A000-memory.dmp

Filesize
1.9MB

Download
memory/2604-16-0x0000000001D50000-0x0000000001D51000-memory.dmp

Filesize
4KB

Download
memory/2604-12-0x0000000140000000-0x00000001402C8000-memory.dmp

Filesize
2.8MB

Download
memory/2604-17-0x0000000002430000-0x000000000261A000-memory.dmp

Filesize
1.9MB

Download
memory/2604-19-0x0000000140000000-0x00000001402C8000-memory.dmp

Filesize
2.8MB

Download

Analysis

Sharing