Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
10/07/2024, 16:26
General
- Target 2024-07-10_01ea2b1c9a0b61e116702669d3dc2c7a_magniber.exe
- Size 19.5MB
- Sample240710-txjxsazfpd
- SHA256 6e4c205152808d711e7b05829c4ce19665a2254bdd641f7b02013aa1da462697
Malware Config
Signatures
- Banload
Banload variants download malicious files, then install and execute the files.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Modifies registry class 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_01ea2b1c9a0b61e116702669d3dc2c7a_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_01ea2b1c9a0b61e116702669d3dc2c7a_magniber.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_01ea2b1c9a0b61e116702669d3dc2c7a_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_01ea2b1c9a0b61e116702669d3dc2c7a_magniber.exe"2⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2124-8-0x0000000000400000-0x00000000028F2000-memory.dmp
memory/2124-21-0x0000000000400000-0x00000000028F2000-memory.dmp
memory/3296-2-0x0000000004D10000-0x0000000004F26000-memory.dmp
memory/3296-9-0x0000000004D10000-0x0000000004F26000-memory.dmp
memory/3296-10-0x0000000000400000-0x00000000028F2000-memory.dmp
memory/3296-15-0x0000000000400000-0x00000000028F2000-memory.dmp
memory/3296-17-0x0000000000400000-0x00000000028F2000-memory.dmp
memory/3296-20-0x0000000004580000-0x00000000045A0000-memory.dmp
memory/3296-19-0x0000000000400000-0x00000000028F2000-memory.dmp
memory/3296-22-0x0000000000400000-0x00000000028F2000-memory.dmp