Analysis
-
max time kernel
166s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2023 20:56
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe
-
Size
6.8MB
-
MD5
c7fdb33ba0f80dd681c577148f95de8e
-
SHA1
b8226fe6b4bca6567dca37f7f798fb229e2d40c9
-
SHA256
5e13b5430b81c274374c6f873e9abaa511f514b4327a646ca1d4edd32c26d2cf
-
SHA512
9fb97339fc5031d0b96abf25bab097175affa7eef4e8d916db5492cdcdfbbe3d2094fa56801d1cd9460a47a358d29ded3103aca286964a779fd30d719f80fd1f
-
SSDEEP
98304:uXra3iRjoH3Y7j268B+5J2527/K0TXAWHUMFRZplp+dy7JfEfsjbq84FvcxslVl9:uXrxwY7p8r27rh0GKCJsMb1wcxsh
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe -
Modifies registry class 5 IoCs
Processes:
2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC5AC5F4-159C-C501-BAB5-C44CF9230415} 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC5AC5F4-159C-C501-BAB5-C44CF9230415}\ = "PSTypeInfo" 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC5AC5F4-159C-C501-BAB5-C44CF9230415}\InprocServer32 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC5AC5F4-159C-C501-BAB5-C44CF9230415}\InprocServer32\ = "C:\\Windows\\SysWOW64\\oleaut32.dll" 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC5AC5F4-159C-C501-BAB5-C44CF9230415}\InprocServer32\ThreadingModel = "Both" 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exepid process 3624 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exedescription pid process Token: 33 3624 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe Token: SeIncBasePriorityPrivilege 3624 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exepid process 3624 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe 3624 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe 3624 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe 3624 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exepid process 3624 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe 3624 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe 3624 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe 3624 2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe"1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9B
MD56816e9c42f83840996d32b0621d0b147
SHA171be9c2771afe119eefc2ac8ed336b9b13b5b98a
SHA2569fdd4bed56e33994bad29a0e005f1de20e5d76fd485a1f816d8ddfef5bc7bad3
SHA512009cde661ef4d76e6c226aa78dcf884055382a43d1dce5921ddae26d5b30ef1b794194b0a08e49bfeb6740d578559e14b4d7b6b4c7a6a80badb7bc7226ea6c9b