banload | abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac

General

Target

abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Size

2.1MB
MD5

1bb2c884abfc605fa496242bdac65b78
SHA1

bc24248113fabf1a963c3be78bc2d03524e37bbf
SHA256

abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac
SHA512

dd2c0e62cb09ee208d149cc538531d9ce51d46da3137e44533f9ca436060bf855373d8b54deee323a858e088d4afbad5f398bb31a7c7346a908a6542d1ac10a5
SSDEEP

49152:upbRm4GPK/M62mTsPOfY2HTmktexoVDn99c1/0VXKcgSdc+:u1GS/hf7Vt0uDnu0VXRBB

Score

10^/10

banload downloader dropper persistence privilege_escalation trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\DefaultIcon	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\DefaultIcon\ = "%SystemRoot%\\system32\\Vault.dll,-1"	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\InProcServer32\ThreadingModel = "Apartment"	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\ShellFolder	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\ShellFolder\Attributes = "2684354560"	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\System.ApplicationName = "Microsoft.CredentialManager"	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\System.ControlPanel.EnableInSafeMode = "3"	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\InProcServer32\ = "%SystemRoot%\\System32\\shdocvw.dll"	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\Instance\InitPropertyBag\ResourceDLL = "%SystemRoot%\\system32\\Vault.dll"	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\InfoTip = "@%SystemRoot%\\system32\\Vault.dll,-2"	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\Instance	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\Instance\CLSID = "{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\Instance\InitPropertyBag	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\Instance\InitPropertyBag\ResourceID = "100"	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\ShellFolder\WantsParseDisplayName	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\ = "Credential Manager"	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\System.ControlPanel.Category = "9"	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\InProcServer32	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\System.Software.TasksFileUrl = "Internal"	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0551B589-8D80-3BD4-203E-7746B46ABFC1}\LocalizedString = "@%SystemRoot%\\system32\\Vault.dll,-1"	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1148	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
Token: SeIncBasePriorityPrivilege	1148	abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe

C:\Users\Admin\AppData\Local\Temp\abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe
"C:\Users\Admin\AppData\Local\Temp\abef29a0f9056beda2dba3faa5d42b069d0880437c80fbe65e27ebd6d2bbfdac.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-0-0x00000000023B0000-0x000000000259A000-memory.dmp

Filesize
1.9MB

Download
memory/1148-7-0x00000000023B0000-0x000000000259A000-memory.dmp

Filesize
1.9MB

Download
memory/1148-12-0x0000000140000000-0x00000001402A9000-memory.dmp

Filesize
2.7MB

Download
memory/1148-14-0x00000000023B0000-0x000000000259A000-memory.dmp

Filesize
1.9MB

Download
memory/1148-13-0x0000000140000000-0x00000001402A9000-memory.dmp

Filesize
2.7MB

Download
memory/1148-16-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1148-17-0x00000000023B0000-0x000000000259A000-memory.dmp

Filesize
1.9MB

Download
memory/1148-19-0x0000000140000000-0x00000001402A9000-memory.dmp

Filesize
2.7MB

Download

Analysis

Sharing