MalwareUsed by 1 actor

BIOLOAD

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

FIN7

BIOLOAD The loader file name is WinBio.dll (note the uppercase characters) and is placed by the attacker alongside the executable in the same folder (“ WinBioPlugIns "), thus leveraging the default DLL search order.

via fortinet threat researchfortinet.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.005Scheduled TaskEvidence1

What makes this executable even more attractive in the eyes of an attacker is the fact that it is started from a built-in scheduled task named FODCleanupTask... Establishes persistency by using COM objects to access the task scheduler. The malware makes sure the task is enabled, adds a trigger to start it 30 seconds after Windows boots and does not wait for idle state.

T1574.001DLLEvidence1

Adversaries may use this behavior to cause the program to load a malicious DLL, a technique known as DLL search order hijacking (or binary planting).

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

BIOLOAD also has the encrypted payload DLL embedded in it... to decrypt the payload it uses a simple XOR decryption... it relies on the machine name to properly derive the decryption key.

T1218System Binary Proxy ExecutionEvidence1

This is the first public case of FaceFodUninstaller.exe being abused as host process by a threat actor.

T1480.002Mutual ExclusionEvidence1

It then makes sure only a single instance is currently running by creating a named mutex based on environments variables

T1574.001DLLEvidence1

Adversaries may use this behavior to cause the program to load a malicious DLL, a technique known as DLL search order hijacking (or binary planting).

T1620Reflective Code LoadingEvidence1

The worker process loads and executes the payload DLL in-memory.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

fortinet threat researchNews

Dec 26, 2019

Introducing BIOLOAD: FIN7 BOOSTWRITE’s Lost Twin

A FIN7-attributed C++ loader that abuses DLL search order hijacking via FaceFodUninstaller.exe to load a malicious WinBio.dll, establish persistence through a scheduled task, and decrypt and execute an embedded payload DLL in memory. It is tailored per victim machine using the computer name to derive the decryption key.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

BIOLOAD

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

FIN7

via fortinet threat researchfortinet.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.005Scheduled TaskEvidence1

T1574.001DLLEvidence1

Adversaries may use this behavior to cause the program to load a malicious DLL, a technique known as DLL search order hijacking (or binary planting).

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

BIOLOAD also has the encrypted payload DLL embedded in it... to decrypt the payload it uses a simple XOR decryption... it relies on the machine name to properly derive the decryption key.

T1218System Binary Proxy ExecutionEvidence1

This is the first public case of FaceFodUninstaller.exe being abused as host process by a threat actor.

T1480.002Mutual ExclusionEvidence1

It then makes sure only a single instance is currently running by creating a named mutex based on environments variables

T1574.001DLLEvidence1

Adversaries may use this behavior to cause the program to load a malicious DLL, a technique known as DLL search order hijacking (or binary planting).

T1620Reflective Code LoadingEvidence1

The worker process loads and executes the payload DLL in-memory.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

fortinet threat researchNews

Dec 26, 2019

Introducing BIOLOAD: FIN7 BOOSTWRITE’s Lost Twin

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.