Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 05:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe
-
Size
4.5MB
-
MD5
f9ea2b709cbe465f38dc48b567af25d9
-
SHA1
e16d6acc4bc29aeddb5a33a0f61aff3521701207
-
SHA256
e399068864d71d3b5c7e093665a70be63fe3bb3e1893645a3d093362cea8aa0a
-
SHA512
a7ef9c15a9684006915fc90eca8b3ebf4b5a57be3858b3a76f84be13ed9af219cac4c0fdeadccdcce81bad74bf940e68bca6d1b298f98710c007a1e94494cbc2
-
SSDEEP
98304:1tcwzabaTEbMW6iDUWc7tdjfWAFFZ60VE2:Mw+GEgq6dlfZrE2
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2004 2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe 2004 2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe 2004 2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe 2004 2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe 2004 2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe 2004 2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe 2004 2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe 2004 2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2004 2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_f9ea2b709cbe465f38dc48b567af25d9_magniber.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2004