Analysis
-
max time kernel
137s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
26-04-2024 05:45
General
-
Target
2024-04-26_8f1c9e521607a16703b6150237932720_mafia_magniber_qakbot.exe
-
Size
3.4MB
-
MD5
8f1c9e521607a16703b6150237932720
-
SHA1
591edd5b57a0983c38e094508ece6e25931b9d8b
-
SHA256
4fc6dbe47c2036a3e2b6ec5c8ed36ea608c30561ed8adaf89c849c3d51aeb8c0
-
SHA512
eb2bac2be3901675adf0805ebc57274beb5ace6439d3d71be05bace21b7582893fa17c59b02c071f12ed4aa368c84f9c894fa597eebebc610a3c856e334809f0
-
SSDEEP
98304:4GPMSrgibDEJaQGoh0PtQAiW7Htm+4s5bNLt:4irgGEJvKHHt3HB
Score
10/10
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Modifies registry class 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_8f1c9e521607a16703b6150237932720_mafia_magniber_qakbot.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_8f1c9e521607a16703b6150237932720_mafia_magniber_qakbot.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.9MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
2.0MB