Analysis

  • max time kernel
    166s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2023 20:56

General

  • Target

    2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe

  • Size

    6.8MB

  • MD5

    c7fdb33ba0f80dd681c577148f95de8e

  • SHA1

    b8226fe6b4bca6567dca37f7f798fb229e2d40c9

  • SHA256

    5e13b5430b81c274374c6f873e9abaa511f514b4327a646ca1d4edd32c26d2cf

  • SHA512

    9fb97339fc5031d0b96abf25bab097175affa7eef4e8d916db5492cdcdfbbe3d2094fa56801d1cd9460a47a358d29ded3103aca286964a779fd30d719f80fd1f

  • SSDEEP

    98304:uXra3iRjoH3Y7j268B+5J2527/K0TXAWHUMFRZplp+dy7JfEfsjbq84FvcxslVl9:uXrxwY7p8r27rh0GKCJsMb1wcxsh

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-25_c7fdb33ba0f80dd681c577148f95de8e_magniber_JC.exe"
    1⤵
    • Checks BIOS information in registry
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\OneNoteGem\OneAppGemMenu\gemmenuuwpinfo.txt

    Filesize

    9B

    MD5

    6816e9c42f83840996d32b0621d0b147

    SHA1

    71be9c2771afe119eefc2ac8ed336b9b13b5b98a

    SHA256

    9fdd4bed56e33994bad29a0e005f1de20e5d76fd485a1f816d8ddfef5bc7bad3

    SHA512

    009cde661ef4d76e6c226aa78dcf884055382a43d1dce5921ddae26d5b30ef1b794194b0a08e49bfeb6740d578559e14b4d7b6b4c7a6a80badb7bc7226ea6c9b

  • memory/3624-20-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/3624-21-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/3624-10-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/3624-14-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/3624-15-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/3624-17-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/3624-8-0x0000000003450000-0x0000000003651000-memory.dmp

    Filesize

    2.0MB

  • memory/3624-0-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/3624-19-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/3624-23-0x0000000003450000-0x0000000003651000-memory.dmp

    Filesize

    2.0MB

  • memory/3624-22-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/3624-25-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB

  • memory/3624-26-0x0000000003450000-0x0000000003651000-memory.dmp

    Filesize

    2.0MB

  • memory/3624-2-0x0000000003450000-0x0000000003651000-memory.dmp

    Filesize

    2.0MB

  • memory/3624-33-0x0000000000400000-0x0000000001260000-memory.dmp

    Filesize

    14.4MB