Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21-05-2024 16:42
General
-
Target
2024-05-21_0e4924ada6cf54c65ad1e7452a002acc_magniber.exe
-
Size
19.2MB
-
MD5
0e4924ada6cf54c65ad1e7452a002acc
-
SHA1
70de4a435716aefae28f646eb38cc1669dd96782
-
SHA256
5fc25a7484d832b7c60ff1bc9c3e844e9b2c0bdd98023ffc05e512edb4c6b86e
-
SHA512
3f98aaa9c234e359f8fa305058cf2dc0001417a985a44c0e72b0462bc5bbd45addf85acf0f670893a40591bc7aa8b8152c56e3f5d0909b2977066802eb476926
-
SSDEEP
393216:RaVxxnA/agezlwdj+KyN4+XBhu/rJwWhWfmxXwga+Zs3pbwMbcS8QBlZj/:Gx4afzKdj2LSrJwlmxXwga+u3pbJCilp
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 5 IoCs
-
Modifies registry class 23 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_0e4924ada6cf54c65ad1e7452a002acc_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_0e4924ada6cf54c65ad1e7452a002acc_magniber.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5a6521b960e984df83a8e2fcca4b8bca8
SHA10b6cfbb16f6ecd97a88999c4ba911ead20f17c3a
SHA25667d8b1cfc778629004f5e70a68e5f53c4ae752ab26f9d682c58789f2ad896372
SHA512371ccc7071d456df92d4857e93ee0ae7950f7541171aa6d66308ef82cecb372a04abe6f66bef4147b9ac316ad2961f8e6ae5e4c6de891647766b3728d6068407
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
2.0MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
2.0MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
68.9MB
-
Filesize
2.0MB
-
Filesize
68.9MB
-
Filesize
2.0MB
-
Filesize
68.9MB