Analysis

  • max time kernel
    141s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03-05-2024 11:41

General

  • Target

    2024-05-03_d30ccf0a28e6fc788601e01f38fdc7db_magniber.exe

  • Size

    5.5MB

  • MD5

    d30ccf0a28e6fc788601e01f38fdc7db

  • SHA1

    fef23c0535ab2b7ceb7c2bec4ecb6837a4f0189f

  • SHA256

    15cbaa5e7c3db729ec2a4062aaed7f2d481efca5f5d875e4b3ef1d6483dbb0ab

  • SHA512

    a2f7e989d2d6d715ab1ee1d52f50143413811a04fb33fef7e9a3c52cca0ae303d0e194a76246b379805bbf4f8c9257b17e5edf35de952fc8fa5ab609a22b2a0f

  • SSDEEP

    98304:LUGUCECOmlvm/1ZVhPtQAkxyFUbt2aKGlx1zrda4RhHc61q1sBDQ4djloa183FNz:LUGUC1lviBeyFI2aKEJ4UZq1WJj+TFd

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Modifies registry class 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-03_d30ccf0a28e6fc788601e01f38fdc7db_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-03_d30ccf0a28e6fc788601e01f38fdc7db_magniber.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1308

Network

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1308-0-0x00000000030E0000-0x00000000032EC000-memory.dmp
    Filesize

    2.0MB

  • memory/1308-7-0x0000000000400000-0x00000000011C2000-memory.dmp
    Filesize

    13.8MB

  • memory/1308-8-0x00000000030E0000-0x00000000032EC000-memory.dmp
    Filesize

    2.0MB

  • memory/1308-15-0x0000000000400000-0x00000000011C2000-memory.dmp
    Filesize

    13.8MB

  • memory/1308-11-0x0000000000400000-0x00000000011C2000-memory.dmp
    Filesize

    13.8MB

  • memory/1308-16-0x0000000000400000-0x00000000011C2000-memory.dmp
    Filesize

    13.8MB

  • memory/1308-17-0x0000000000400000-0x00000000011C2000-memory.dmp
    Filesize

    13.8MB

  • memory/1308-12-0x0000000000400000-0x00000000011C2000-memory.dmp
    Filesize

    13.8MB

  • memory/1308-18-0x0000000000400000-0x00000000011C2000-memory.dmp
    Filesize

    13.8MB

  • memory/1308-21-0x00000000030E0000-0x00000000032EC000-memory.dmp
    Filesize

    2.0MB

  • memory/1308-20-0x0000000000400000-0x00000000011C2000-memory.dmp
    Filesize

    13.8MB

  • memory/1308-19-0x0000000000400000-0x00000000011C2000-memory.dmp
    Filesize

    13.8MB

  • memory/1308-22-0x0000000002B80000-0x0000000002BBC000-memory.dmp
    Filesize

    240KB

  • memory/1308-28-0x00000000003E0000-0x00000000003E1000-memory.dmp
    Filesize

    4KB

  • memory/1308-23-0x0000000002B80000-0x0000000002BBC000-memory.dmp
    Filesize

    240KB

  • memory/1308-30-0x0000000003BA0000-0x0000000003C1F000-memory.dmp
    Filesize

    508KB

  • memory/1308-36-0x0000000003030000-0x0000000003055000-memory.dmp
    Filesize

    148KB

  • memory/1308-35-0x0000000003030000-0x0000000003055000-memory.dmp
    Filesize

    148KB

  • memory/1308-41-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
    Filesize

    4KB

  • memory/1308-43-0x0000000005120000-0x000000000512F000-memory.dmp
    Filesize

    60KB

  • memory/1308-42-0x0000000005120000-0x000000000512F000-memory.dmp
    Filesize

    60KB

  • memory/1308-46-0x0000000004EC0000-0x0000000004EC1000-memory.dmp
    Filesize

    4KB

  • memory/1308-47-0x00000000030E0000-0x00000000032EC000-memory.dmp
    Filesize

    2.0MB

  • memory/1308-48-0x0000000000400000-0x00000000011C2000-memory.dmp
    Filesize

    13.8MB

  • memory/1308-50-0x00000000003E0000-0x00000000003E1000-memory.dmp
    Filesize

    4KB

  • memory/1308-51-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
    Filesize

    4KB

  • memory/1308-52-0x0000000004EC0000-0x0000000004EC1000-memory.dmp
    Filesize

    4KB