Analysis

  • max time kernel
    222s
  • max time network
    234s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-10-2023 13:18

General

  • Target

    NEAS.2023-09-07_a6ba80202c8358ed7204c5e4c3e99dc3_magniber_JC.exe

  • Size

    10.8MB

  • MD5

    a6ba80202c8358ed7204c5e4c3e99dc3

  • SHA1

    a54292767d6cb0596576b61583671d33e69c74e5

  • SHA256

    12c3619eb1b5b684cba9af48a522d3173559853e2fea4b4ecf88a64ff1483113

  • SHA512

    7954d5777529f4e7313d19c49474deeace8041a388d716f4ad03404fdf0137031cc5c296f36f6874f56fd0e7a6b293ca7d4acef00a5656b087765e22304974b7

  • SSDEEP

    196608:4XPnmnYK8xik6H0GTtMh3EvMoUWj100UajlwNHjD9BOegBDy5R34Y:qmnnK6vT+hUf500UmqNHjhBDgBGU

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_a6ba80202c8358ed7204c5e4c3e99dc3_magniber_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_a6ba80202c8358ed7204c5e4c3e99dc3_magniber_JC.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4100
    • C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_a6ba80202c8358ed7204c5e4c3e99dc3_magniber_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_a6ba80202c8358ed7204c5e4c3e99dc3_magniber_JC.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3156

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3156-15-0x0000000003DE0000-0x0000000003FEC000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-22-0x0000000000400000-0x000000000195D000-memory.dmp

    Filesize

    21.4MB

  • memory/3156-4-0x0000000000400000-0x000000000195D000-memory.dmp

    Filesize

    21.4MB

  • memory/3156-10-0x0000000003DE0000-0x0000000003FEC000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-16-0x0000000000400000-0x000000000195D000-memory.dmp

    Filesize

    21.4MB

  • memory/3156-14-0x0000000000400000-0x000000000195D000-memory.dmp

    Filesize

    21.4MB

  • memory/3156-3-0x0000000003DE0000-0x0000000003FEC000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-27-0x0000000000400000-0x000000000195D000-memory.dmp

    Filesize

    21.4MB

  • memory/3156-19-0x0000000003DE0000-0x0000000003FEC000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-18-0x0000000000400000-0x000000000195D000-memory.dmp

    Filesize

    21.4MB

  • memory/3156-17-0x0000000000400000-0x000000000195D000-memory.dmp

    Filesize

    21.4MB

  • memory/3156-20-0x0000000003DE0000-0x0000000003FEC000-memory.dmp

    Filesize

    2.0MB

  • memory/4100-13-0x0000000000400000-0x000000000195D000-memory.dmp

    Filesize

    21.4MB

  • memory/4100-0-0x0000000000400000-0x000000000195D000-memory.dmp

    Filesize

    21.4MB