Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-09-2024 18:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe
-
Size
1.9MB
-
MD5
640a2b28957aeb7b3147b796a3e9fe57
-
SHA1
5998e9ec9a3574c62bb73179f5b212b19add2bc0
-
SHA256
403fe5fca6fe4c90585fbf7533c7755619a5d5455933b5798eaf95b14bd510ed
-
SHA512
4887f11085ae8ab85258445c1e902eb69901f9cb2720cf8251985662872d83aac150e32bbdb797fd2a6197da2b79a575b06ae70bef37ac403b2fb9d7f9ff7365
-
SSDEEP
49152:XbwTDIrh3crgiLGBLHTLJRPgMnlsEqSb0q5VWy7EeNL:8TDIrh3crkr5gMnlsEqGPtQAL
Malware Config
Extracted
Family
azorult
C2
http://account.protonvpn.store/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2688 set thread context of 2124 2688 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 34 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe -
Modifies registry class 42 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7} 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\XEuwgq = "Wd" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\nAerwleqo = "uYHEfeZDakZIHpcHY" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\BkparvitqyxvK = "bzIQYhNRgrPawDV\x7fWjT~" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649} 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\pzndSkvoyNbrC = "D[UvQWBvbXOfY`]Xd|RQIIG" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\jLwErdPpxBal = "dcz_b]AciFwJtatt}\\fd~o[eNtzDg|" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\BkparvitqyxvK = "aXonblv@DwS`{z]NZOD[" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\XEuwgq = "iX" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\jLwErdPpxBal = "dcz_b]AciFwJtatt}\\fdso[eNtznWF" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\BkparvitqyxvK = "aXolBlv@DwS`{z]NZOD[" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\jLwErdPpxBal = "ZJqLKQB~Ey}hSNbXSjUXPRrktae[gQ" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\CzYzLoot = "nrS[`lvFh[TiQDnhqd`Efl" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\XEuwgq = "jl" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\CzYzLoot = "Nw`\x7f|A^qfEaWb}VShgLwGi" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\doyp = "k|\\BPNW@S}cGs[DEsKN" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\CzYzLoot = "Nw`\x7f|A^qfEQWb}VShg|wGi" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\XEuwgq = "@X" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\jLwErdPpxBal = "dcz_b]AciFwJtatt}\\fdpo[eNtsBMw" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\XEuwgq = "}P" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\jLwErdPpxBal = "ZJqLKQB~Ey}hSNbXSjUXRRrktagwTx" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\ = "Microsoft AVI Files" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\AVIFile 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\zhjhwqsfxdcXj = "LqUGkXAiC_wnEaIuthg{pkahLa" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\dVenemhvLlR = "Ue\x7f]kwfLQ^twkiyhvEJRw_PDWQ_guBUB" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\jLwErdPpxBal = "dcz_b]AciFwJtatt}\\fdqo[eNtxBdo" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\doyp = "krbOuUpx`j@q\x7f]~{c[O" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\zhjhwqsfxdcXj = "N{HtzN|I{kO`nflwKC_PGGrc]_" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\XEuwgq = "c|" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\XEuwgq = "t@" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\jLwErdPpxBal = "ZJqLKQB~Ey}hSNbXSjUX]RrktaeqWk" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\AVIFile\ = "7" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\InprocServer32 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\InprocServer32\ThreadingModel = "Both" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\dVenemhvLlR = "Utt\\\x7fA|oGJh_CsSlFb[N~Zy|R{HWqz_t" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\nAerwleqo = "`sVxCZIohuIRVCGfW" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\CzYzLoot = "nrS[`lvFh[diQDnhqdPEfl" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\InprocServer32\ = "%SystemRoot%\\SysWow64\\avifil32.dll" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\pzndSkvoyNbrC = "@g[f_FCOG|uM`Zo]O{POdXm" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\jLwErdPpxBal = "ZJqLKQB~Ey}hSNbXSjUXSRrktalw}`" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\{502E4348-1366-13D1-B2E4-0060975B8649}\XEuwgq = "~d" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C6D12CC-C522-0FA5-34C5-DB2168552EE7}\BkparvitqyxvK = "bzISyhNRgrPawDV\x7fWjT~" 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: 33 2540 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Token: SeIncBasePriorityPrivilege 2540 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Token: 33 2540 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Token: SeIncBasePriorityPrivilege 2540 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Token: SeRestorePrivilege 2540 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Token: SeBackupPrivilege 2540 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Token: 33 2688 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Token: SeIncBasePriorityPrivilege 2688 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Token: 33 2688 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Token: SeIncBasePriorityPrivilege 2688 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Token: SeRestorePrivilege 2688 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe Token: SeBackupPrivilege 2688 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 2540 wrote to memory of 2872 2540 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 32 PID 2540 wrote to memory of 2872 2540 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 32 PID 2540 wrote to memory of 2872 2540 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 32 PID 2540 wrote to memory of 2872 2540 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 32 PID 2540 wrote to memory of 2872 2540 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 32 PID 2540 wrote to memory of 2872 2540 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 32 PID 2540 wrote to memory of 2872 2540 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 32 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 588 wrote to memory of 2540 588 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 30 PID 2872 wrote to memory of 2688 2872 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 33 PID 2872 wrote to memory of 2688 2872 2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exeC:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe V83⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exeC:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe V84⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe"5⤵
- System Location Discovery: System Language Discovery
PID:2124
-
-
-
-