Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
16-04-2024 15:03
General
-
Target
2024-04-16_672605ab8056f4342cb44f5f47cbb4cb_magniber.exe
-
Size
23.2MB
-
MD5
672605ab8056f4342cb44f5f47cbb4cb
-
SHA1
1ed8c56100565159e83ce8f7d903d29a1b287050
-
SHA256
ff0d55b77411509c652cad267493a690d62d856602d348181cf1f1bdaf877c26
-
SHA512
4d482de9229cb18abcd31827b5a7a02ea493e6d9121c30a87292fa6b1e7bb566ad7335d6105b7590a1a54db21391b00037ec7348fa38e77041257d00dd493d5e
-
SSDEEP
393216:3FgboA6zuuVOXtl1RFStx6lHWw8CkNYVBYsOBnZKd722rGIeR:m8uLtYmHuNYVBYtnZKBDYR
Score
10/10
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Modifies registry class 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_672605ab8056f4342cb44f5f47cbb4cb_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_672605ab8056f4342cb44f5f47cbb4cb_magniber.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_672605ab8056f4342cb44f5f47cbb4cb_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_672605ab8056f4342cb44f5f47cbb4cb_magniber.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
38.0MB
-
Filesize
38.0MB
-
Filesize
2.0MB
-
Filesize
38.0MB
-
Filesize
38.0MB
-
Filesize
2.0MB
-
Filesize
38.0MB
-
Filesize
2.0MB
-
Filesize
38.0MB
-
Filesize
38.0MB
-
Filesize
38.0MB
-
Filesize
38.0MB
-
Filesize
38.0MB
-
Filesize
38.0MB