Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04-03-2024 05:01

General

  • Target

    2024-03-04_84077d0d389983e7dc332740ccbade19_mafia_magniber.exe

  • Size

    4.9MB

  • MD5

    84077d0d389983e7dc332740ccbade19

  • SHA1

    51e54abab6878b1c14a71557a2c48152b829df8c

  • SHA256

    7c620843361c577c94297f4a16eba109328dd8880b776b6764baeb2d898865a4

  • SHA512

    3620a43ac1b287aaf65ce0c8f06f594f70adf1f9791c4ffc7df4631611accff9f58dc6e9777ee7729874db5a895bc26632bf21fdb264cc24346fc23f04333543

  • SSDEEP

    98304:GS5I0l9dF0PWG/tPfX8i3hmwIAbhSO9qBS6g1lu:GS5j9mPB/VX8MmzA9RsSx

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies registry class 13 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-04_84077d0d389983e7dc332740ccbade19_mafia_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-04_84077d0d389983e7dc332740ccbade19_mafia_magniber.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Users\Admin\AppData\Local\Temp\2024-03-04_84077d0d389983e7dc332740ccbade19_mafia_magniber.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-03-04_84077d0d389983e7dc332740ccbade19_mafia_magniber.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2220-1-0x0000000000400000-0x0000000000E5F000-memory.dmp

    Filesize

    10.4MB

  • memory/2220-2-0x00000000039A0000-0x0000000003BAC000-memory.dmp

    Filesize

    2.0MB

  • memory/2220-10-0x00000000039A0000-0x0000000003BAC000-memory.dmp

    Filesize

    2.0MB

  • memory/2220-9-0x00000000039A0000-0x0000000003BAC000-memory.dmp

    Filesize

    2.0MB

  • memory/2220-14-0x0000000000400000-0x0000000000E5F000-memory.dmp

    Filesize

    10.4MB

  • memory/2220-16-0x00000000039A0000-0x0000000003BAC000-memory.dmp

    Filesize

    2.0MB

  • memory/2236-0-0x0000000000400000-0x0000000000E5F000-memory.dmp

    Filesize

    10.4MB

  • memory/2236-3-0x0000000002AE0000-0x000000000353F000-memory.dmp

    Filesize

    10.4MB

  • memory/2236-13-0x0000000000400000-0x0000000000E5F000-memory.dmp

    Filesize

    10.4MB

  • memory/2236-15-0x0000000002AE0000-0x000000000353F000-memory.dmp

    Filesize

    10.4MB