Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27-01-2024 16:45
General
-
Target
2024-01-27_2e47762ed5f94ac03e28a9408398842f_magniber.exe
-
Size
19.2MB
-
MD5
2e47762ed5f94ac03e28a9408398842f
-
SHA1
d1b3d61b967c88013323d469b9ca06758a6fb8b3
-
SHA256
f18612de64687383f0e5a85bd805cc602615c9ba78563743c1e38ecbe643391a
-
SHA512
dcae7637e20e2caee4f47aaa050202ffad694c49766adcea647606168d954cc25184af41d1cff4c37dd4b0a014b1141759eb014d6596927e2f8fba752b5da5d2
-
SSDEEP
393216:OaVp4ReDeM+kkza+hsEEfhFxw1Rs8gRebKR/aN0CEzp0t:Fp4UF+h6hzwTsHeGR/HCEt4
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 5 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_2e47762ed5f94ac03e28a9408398842f_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_2e47762ed5f94ac03e28a9408398842f_magniber.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5bdcd9908a7ebded0075ba4ac9b64f55b
SHA1e441e1e621cad65d2b987c84959fd2380d35bea3
SHA256c130604794a089e4eeb3a336a4b3079bac1b8128732fc10e3739b01883537980
SHA512a9d399315af0dbabcd318894a0ab4dcd94a083c7fe2261afa57cf140594d7633262dd50f436c08ac4048a02db96bcae3faeefb7eb20300f62d5bb3dca397a2c9
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
2.0MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
68.9MB
-
Filesize
2.0MB
-
Filesize
68.9MB