Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04/05/2024, 20:47

General

  • Target

    2024-05-04_ffc509e3271055eb48998822eb4c80cc_bkransomware_magniber.exe

  • Size

    20.9MB

  • MD5

    ffc509e3271055eb48998822eb4c80cc

  • SHA1

    c77ef67b7a67ad2940476a165fd10ba16a736d75

  • SHA256

    baedf707f3f4c1d8272c8484c969c9e3e4d96e81af9331ff7e2048647ba07bc1

  • SHA512

    322cb593a408d1092fcdbb8546fb7549258db3428554b1c5c1e9784d2f78100b752d6a32feb382ef090d561f700058bb42753ce8ce18debe6b2b82a520dc4cca

  • SSDEEP

    393216:bDjB+WUWPWYU00TE0Cv/W5DjB+WUWPWYUV5IMlP:fjBrUWPWYU00TJCvCjBrUWPWYUV5IMN

Score
9/10

Malware Config

Signatures

  • Detects executables packed with Enigma 2 IoCs
  • Detects packed executables observed in Molerats 2 IoCs
  • Program crash 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-04_ffc509e3271055eb48998822eb4c80cc_bkransomware_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-04_ffc509e3271055eb48998822eb4c80cc_bkransomware_magniber.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1528
      2⤵
      • Program crash
      PID:2484

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2228-0-0x0000000000400000-0x00000000008FF000-memory.dmp

          Filesize

          5.0MB

        • memory/2228-1-0x0000000077460000-0x0000000077461000-memory.dmp

          Filesize

          4KB

        • memory/2228-4-0x0000000010000000-0x0000000010027000-memory.dmp

          Filesize

          156KB

        • memory/2228-6-0x0000000010000000-0x0000000010027000-memory.dmp

          Filesize

          156KB

        • memory/2228-10-0x0000000004260000-0x00000000043BD000-memory.dmp

          Filesize

          1.4MB

        • memory/2228-13-0x0000000002C90000-0x0000000002CB7000-memory.dmp

          Filesize

          156KB

        • memory/2228-16-0x0000000002CD0000-0x0000000002CF1000-memory.dmp

          Filesize

          132KB

        • memory/2228-18-0x0000000002D10000-0x0000000002D55000-memory.dmp

          Filesize

          276KB

        • memory/2228-22-0x00000000044C0000-0x000000000450C000-memory.dmp

          Filesize

          304KB

        • memory/2228-24-0x0000000004510000-0x000000000454E000-memory.dmp

          Filesize

          248KB

        • memory/2228-29-0x00000000047C0000-0x000000000490A000-memory.dmp

          Filesize

          1.3MB

        • memory/2228-34-0x0000000004550000-0x0000000004586000-memory.dmp

          Filesize

          216KB

        • memory/2228-33-0x0000000004910000-0x0000000004989000-memory.dmp

          Filesize

          484KB

        • memory/2228-32-0x0000000000400000-0x00000000008FF000-memory.dmp

          Filesize

          5.0MB

        • memory/2228-41-0x0000000004AB0000-0x0000000004B17000-memory.dmp

          Filesize

          412KB

        • memory/2228-40-0x0000000004990000-0x0000000004AA8000-memory.dmp

          Filesize

          1.1MB

        • memory/2228-39-0x0000000010000000-0x0000000010027000-memory.dmp

          Filesize

          156KB

        • memory/2228-45-0x0000000004B60000-0x0000000004BC2000-memory.dmp

          Filesize

          392KB

        • memory/2228-44-0x0000000004260000-0x00000000043BD000-memory.dmp

          Filesize

          1.4MB

        • memory/2228-48-0x0000000002C90000-0x0000000002CB7000-memory.dmp

          Filesize

          156KB

        • memory/2228-50-0x0000000005150000-0x00000000051CB000-memory.dmp

          Filesize

          492KB

        • memory/2228-49-0x0000000002CD0000-0x0000000002CF1000-memory.dmp

          Filesize

          132KB

        • memory/2228-55-0x0000000004BD0000-0x0000000004C08000-memory.dmp

          Filesize

          224KB

        • memory/2228-56-0x00000000051D0000-0x000000000520A000-memory.dmp

          Filesize

          232KB

        • memory/2228-59-0x0000000002D10000-0x0000000002D55000-memory.dmp

          Filesize

          276KB

        • memory/2228-60-0x0000000004C10000-0x0000000004C39000-memory.dmp

          Filesize

          164KB

        • memory/2228-66-0x00000000054C0000-0x00000000054DD000-memory.dmp

          Filesize

          116KB

        • memory/2228-63-0x00000000054C0000-0x00000000054DD000-memory.dmp

          Filesize

          116KB

        • memory/2228-68-0x00000000054C0000-0x00000000054DD000-memory.dmp

          Filesize

          116KB

        • memory/2228-67-0x00000000044C0000-0x000000000450C000-memory.dmp

          Filesize

          304KB

        • memory/2228-69-0x0000000005520000-0x0000000005529000-memory.dmp

          Filesize

          36KB

        • memory/2228-70-0x0000000005520000-0x0000000005524000-memory.dmp

          Filesize

          16KB

        • memory/2228-76-0x0000000005520000-0x0000000005521000-memory.dmp

          Filesize

          4KB

        • memory/2228-79-0x0000000005520000-0x0000000005524000-memory.dmp

          Filesize

          16KB

        • memory/2228-82-0x0000000005520000-0x0000000005522000-memory.dmp

          Filesize

          8KB

        • memory/2228-85-0x0000000005520000-0x0000000005521000-memory.dmp

          Filesize

          4KB

        • memory/2228-88-0x0000000005520000-0x0000000005522000-memory.dmp

          Filesize

          8KB

        • memory/2228-91-0x0000000005520000-0x0000000005522000-memory.dmp

          Filesize

          8KB

        • memory/2228-94-0x0000000005520000-0x0000000005522000-memory.dmp

          Filesize

          8KB

        • memory/2228-97-0x0000000005520000-0x0000000005522000-memory.dmp

          Filesize

          8KB

        • memory/2228-100-0x0000000005520000-0x0000000005521000-memory.dmp

          Filesize

          4KB

        • memory/2228-103-0x0000000005520000-0x0000000005521000-memory.dmp

          Filesize

          4KB

        • memory/2228-106-0x0000000005520000-0x0000000005522000-memory.dmp

          Filesize

          8KB

        • memory/2228-109-0x0000000005520000-0x0000000005522000-memory.dmp

          Filesize

          8KB

        • memory/2228-112-0x00000000057D0000-0x00000000057D1000-memory.dmp

          Filesize

          4KB

        • memory/2228-115-0x00000000057F0000-0x00000000057F1000-memory.dmp

          Filesize

          4KB

        • memory/2228-118-0x00000000057F0000-0x00000000057F1000-memory.dmp

          Filesize

          4KB

        • memory/2228-121-0x00000000057F0000-0x00000000057F1000-memory.dmp

          Filesize

          4KB

        • memory/2228-124-0x0000000005830000-0x0000000005831000-memory.dmp

          Filesize

          4KB

        • memory/2228-433-0x0000000004510000-0x000000000454E000-memory.dmp

          Filesize

          248KB

        • memory/2228-434-0x00000000047C0000-0x000000000490A000-memory.dmp

          Filesize

          1.3MB

        • memory/2228-439-0x0000000004910000-0x0000000004989000-memory.dmp

          Filesize

          484KB

        • memory/2228-440-0x000000000A720000-0x000000000A737000-memory.dmp

          Filesize

          92KB

        • memory/2228-442-0x0000000004550000-0x0000000004586000-memory.dmp

          Filesize

          216KB

        • memory/2228-447-0x0000000004AB0000-0x0000000004B17000-memory.dmp

          Filesize

          412KB

        • memory/2228-446-0x0000000004990000-0x0000000004AA8000-memory.dmp

          Filesize

          1.1MB

        • memory/2228-448-0x0000000004B60000-0x0000000004BC2000-memory.dmp

          Filesize

          392KB

        • memory/2228-449-0x0000000005150000-0x00000000051CB000-memory.dmp

          Filesize

          492KB

        • memory/2228-450-0x0000000004BD0000-0x0000000004C08000-memory.dmp

          Filesize

          224KB

        • memory/2228-451-0x00000000051D0000-0x000000000520A000-memory.dmp

          Filesize

          232KB

        • memory/2228-455-0x0000000004C10000-0x0000000004C39000-memory.dmp

          Filesize

          164KB

        • memory/2228-456-0x00000000054C0000-0x00000000054DD000-memory.dmp

          Filesize

          116KB

        • memory/2228-460-0x000000000A720000-0x000000000A737000-memory.dmp

          Filesize

          92KB