Analysis

  • max time kernel
    142s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13-10-2023 20:56

General

  • Target

    2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe

  • Size

    6.8MB

  • MD5

    c7fdb33ba0f80dd681c577148f95de8e

  • SHA1

    b8226fe6b4bca6567dca37f7f798fb229e2d40c9

  • SHA256

    5e13b5430b81c274374c6f873e9abaa511f514b4327a646ca1d4edd32c26d2cf

  • SHA512

    9fb97339fc5031d0b96abf25bab097175affa7eef4e8d916db5492cdcdfbbe3d2094fa56801d1cd9460a47a358d29ded3103aca286964a779fd30d719f80fd1f

  • SSDEEP

    98304:uXra3iRjoH3Y7j268B+5J2527/K0TXAWHUMFRZplp+dy7JfEfsjbq84FvcxslVl9:uXrxwY7p8r27rh0GKCJsMb1wcxsh

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies registry class 17 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe"
    1⤵
    • Checks BIOS information in registry
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\OneNoteGem\OneAppGemMenu\gemmenuuwpinfo.txt

    Filesize

    9B

    MD5

    6816e9c42f83840996d32b0621d0b147

    SHA1

    71be9c2771afe119eefc2ac8ed336b9b13b5b98a

    SHA256

    9fdd4bed56e33994bad29a0e005f1de20e5d76fd485a1f816d8ddfef5bc7bad3

    SHA512

    009cde661ef4d76e6c226aa78dcf884055382a43d1dce5921ddae26d5b30ef1b794194b0a08e49bfeb6740d578559e14b4d7b6b4c7a6a80badb7bc7226ea6c9b

  • memory/2892-19-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/2892-18-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/2892-12-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/2892-13-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/2892-20-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/2892-17-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/2892-7-0x0000000003130000-0x0000000003331000-memory.dmp

    Filesize

    2.0MB

  • memory/2892-0-0x0000000003130000-0x0000000003331000-memory.dmp

    Filesize

    2.0MB

  • memory/2892-15-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/2892-21-0x0000000003130000-0x0000000003331000-memory.dmp

    Filesize

    2.0MB

  • memory/2892-23-0x0000000000340000-0x0000000000341000-memory.dmp

    Filesize

    4KB

  • memory/2892-24-0x0000000003130000-0x0000000003331000-memory.dmp

    Filesize

    2.0MB

  • memory/2892-26-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/2892-30-0x0000000000340000-0x0000000000341000-memory.dmp

    Filesize

    4KB

  • memory/2892-4-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/2892-33-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB