Analysis

  • max time kernel
    142s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 07:08

General

  • Target

    2024-06-19_df767ad4e4e38ae3d7debd66286cb667_magniber.exe

  • Size

    4.1MB

  • MD5

    df767ad4e4e38ae3d7debd66286cb667

  • SHA1

    6ca3be0d83ff6b5a9cd0dc1150b1d9f84696f5b4

  • SHA256

    2fe03eae136cf5742e4a94d3e7b3ec9912a8040334b9ee9b1ff4ef8f2124506a

  • SHA512

    4d0dae7cba7509ac24b3a97184c7e9bc1e3ffd716a1e8885a0a1199ef4e6ab95bed8b5d027d5d9667600b1967683a3ec455b820c9eb01aa3c0e9a8a6be5cad89

  • SSDEEP

    98304:5N8aRI/OfmSoDQQ1Zoo/iPJ0Lvj3x6WpnQMrN4+x:5NXRto9LDiPJ0rjrnQU

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-19_df767ad4e4e38ae3d7debd66286cb667_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-19_df767ad4e4e38ae3d7debd66286cb667_magniber.exe"
    1⤵
    • Checks BIOS information in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2388

Network

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2388-6-0x0000000002B90000-0x0000000002D02000-memory.dmp
    Filesize

    1.4MB

  • memory/2388-1-0x0000000002B90000-0x0000000002D02000-memory.dmp
    Filesize

    1.4MB

  • memory/2388-7-0x0000000000400000-0x0000000000D2A000-memory.dmp
    Filesize

    9.2MB

  • memory/2388-16-0x0000000000400000-0x0000000000D2A000-memory.dmp
    Filesize

    9.2MB

  • memory/2388-17-0x0000000000400000-0x0000000000D2A000-memory.dmp
    Filesize

    9.2MB

  • memory/2388-14-0x0000000000400000-0x0000000000D2A000-memory.dmp
    Filesize

    9.2MB

  • memory/2388-12-0x0000000000400000-0x0000000000D2A000-memory.dmp
    Filesize

    9.2MB

  • memory/2388-13-0x0000000000400000-0x0000000000D2A000-memory.dmp
    Filesize

    9.2MB

  • memory/2388-18-0x0000000000400000-0x0000000000D2A000-memory.dmp
    Filesize

    9.2MB

  • memory/2388-19-0x0000000000400000-0x0000000000D2A000-memory.dmp
    Filesize

    9.2MB

  • memory/2388-20-0x0000000000400000-0x0000000000D2A000-memory.dmp
    Filesize

    9.2MB

  • memory/2388-21-0x0000000002B90000-0x0000000002D02000-memory.dmp
    Filesize

    1.4MB

  • memory/2388-23-0x0000000000E70000-0x0000000000E71000-memory.dmp
    Filesize

    4KB

  • memory/2388-24-0x0000000002B90000-0x0000000002D02000-memory.dmp
    Filesize

    1.4MB

  • memory/2388-26-0x0000000000400000-0x0000000000D2A000-memory.dmp
    Filesize

    9.2MB

  • memory/2388-29-0x0000000002B90000-0x0000000002D02000-memory.dmp
    Filesize

    1.4MB

  • memory/2388-30-0x0000000000E70000-0x0000000000E71000-memory.dmp
    Filesize

    4KB