Analysis
-
max time kernel
142s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
21-05-2024 16:42
General
-
Target
2024-05-21_0e4924ada6cf54c65ad1e7452a002acc_magniber.exe
-
Size
19.2MB
-
MD5
0e4924ada6cf54c65ad1e7452a002acc
-
SHA1
70de4a435716aefae28f646eb38cc1669dd96782
-
SHA256
5fc25a7484d832b7c60ff1bc9c3e844e9b2c0bdd98023ffc05e512edb4c6b86e
-
SHA512
3f98aaa9c234e359f8fa305058cf2dc0001417a985a44c0e72b0462bc5bbd45addf85acf0f670893a40591bc7aa8b8152c56e3f5d0909b2977066802eb476926
-
SSDEEP
393216:RaVxxnA/agezlwdj+KyN4+XBhu/rJwWhWfmxXwga+Zs3pbwMbcS8QBlZj/:Gx4afzKdj2LSrJwlmxXwga+u3pbJCilp
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_0e4924ada6cf54c65ad1e7452a002acc_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_0e4924ada6cf54c65ad1e7452a002acc_magniber.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD59145666dec60ce60bab67e21006b33f1
SHA1004dbd9681355c1af5e669caaf98ca0b0d56dd35
SHA256f39254ce4314465a032e9e46bfdee5263b2e15aca4935397c0f1bb357a32eb03
SHA5123b6611a1db93dbda112affe13c6bdaa6b941d867a724349aa25a77b15d6b40cf93768536f1fe444647b00cb103883e03b2bc277b30904ea4d0a478817a2c45f8
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
68.9MB
-
Filesize
2.0MB
-
Filesize
68.9MB
-
Filesize
2.0MB
-
Filesize
68.9MB
-
Filesize
4KB
-
Filesize
2.0MB