Analysis
-
max time kernel
141s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
14/05/2024, 20:21
General
-
Target
2024-05-14_fcdf9497b815e3c5b8661e7799069750_magniber.exe
-
Size
24.1MB
-
MD5
fcdf9497b815e3c5b8661e7799069750
-
SHA1
ca8160664cc43f241c09ebd77a7dca33cb2674d3
-
SHA256
120d6ee2323cd2789ff173ead0aef6f0644ab11b9ff3533d5834c4ee2f7b2654
-
SHA512
2beebedb5e64268c3c0ab3beca168ccf54f5053d91e3a1694ba41c5ac447d7c88a8563352d9a7f57563772bc11edb51bdc4c3e1e303ca8059b5eb26da1ed13f3
-
SSDEEP
393216:R4opD2KL7xaypjDMLCo5Cn606zo6uPCEf6h:bD2KL7wyV
Score
9/10
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 9 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Enumerates system info in registry 2 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_fcdf9497b815e3c5b8661e7799069750_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_fcdf9497b815e3c5b8661e7799069750_magniber.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58.0MB
-
Filesize
58.0MB
-
Filesize
58.0MB
-
Filesize
58.0MB
-
Filesize
58.0MB
-
Filesize
58.0MB
-
Filesize
58.0MB
-
Filesize
58.0MB
-
Filesize
58.0MB