Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26-06-2024 11:25
General
-
Target
2024-06-26_8b319a3815bd4364a81ea173ff557599_magniber.exe
-
Size
5.9MB
-
MD5
8b319a3815bd4364a81ea173ff557599
-
SHA1
67d93430d0fc77167907ca53a936342cbfec973c
-
SHA256
7bd92ca6811a38beaa623d403906364b1449e9003135794ed427003aafa46333
-
SHA512
f8ce4195c214c3c013f50f64efd2638741982ad022c8c32ed3aa7244e634136f0e1899828157d5b53a707cca9cc171c3dfa24dbf417c756a597d87925fd956b8
-
SSDEEP
98304:NgfS7z6NNaXk9MoCzsFI1UFAWWBeyeDDjT3kynVHM//BTqLb+pirJnvshIE6+JPs:Ng+wvI1Iceyefjbkys//9qupi9vsqn4U
Score
10/10
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 64 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 12 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-26_8b319a3815bd4364a81ea173ff557599_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-26_8b319a3815bd4364a81ea173ff557599_magniber.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-06-26_8b319a3815bd4364a81ea173ff557599_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-26_8b319a3815bd4364a81ea173ff557599_magniber.exe"2⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1976-8-0x00000000030C0000-0x0000000004035000-memory.dmpFilesize
15.5MB
-
memory/1976-0-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/1976-58-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/1976-57-0x00000000030C0000-0x0000000004035000-memory.dmpFilesize
15.5MB
-
memory/2376-36-0x0000000004030000-0x0000000004170000-memory.dmpFilesize
1.2MB
-
memory/2376-11-0x0000000000BAB000-0x0000000000BAC000-memory.dmpFilesize
4KB
-
memory/2376-24-0x0000000000350000-0x0000000000370000-memory.dmpFilesize
128KB
-
memory/2376-34-0x0000000004030000-0x0000000004170000-memory.dmpFilesize
1.2MB
-
memory/2376-22-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-21-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-19-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-17-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-16-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-25-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-43-0x0000000004030000-0x0000000004170000-memory.dmpFilesize
1.2MB
-
memory/2376-41-0x0000000004030000-0x0000000004170000-memory.dmpFilesize
1.2MB
-
memory/2376-40-0x0000000004030000-0x0000000004170000-memory.dmpFilesize
1.2MB
-
memory/2376-39-0x0000000004030000-0x0000000004170000-memory.dmpFilesize
1.2MB
-
memory/2376-38-0x0000000004030000-0x0000000004170000-memory.dmpFilesize
1.2MB
-
memory/2376-37-0x0000000004030000-0x0000000004170000-memory.dmpFilesize
1.2MB
-
memory/2376-1-0x00000000032F0000-0x0000000003461000-memory.dmpFilesize
1.4MB
-
memory/2376-35-0x0000000004030000-0x0000000004170000-memory.dmpFilesize
1.2MB
-
memory/2376-23-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-9-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-31-0x0000000004030000-0x0000000004170000-memory.dmpFilesize
1.2MB
-
memory/2376-32-0x0000000004030000-0x0000000004170000-memory.dmpFilesize
1.2MB
-
memory/2376-30-0x0000000004030000-0x0000000004170000-memory.dmpFilesize
1.2MB
-
memory/2376-28-0x00000000032F0000-0x0000000003461000-memory.dmpFilesize
1.4MB
-
memory/2376-27-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-44-0x00000000032F0000-0x0000000003461000-memory.dmpFilesize
1.4MB
-
memory/2376-51-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-50-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-49-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-48-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-47-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-54-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-53-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-52-0x0000000000400000-0x0000000001375000-memory.dmpFilesize
15.5MB
-
memory/2376-10-0x00000000032F0000-0x0000000003461000-memory.dmpFilesize
1.4MB
-
memory/2376-33-0x0000000004030000-0x0000000004170000-memory.dmpFilesize
1.2MB
-
memory/2376-60-0x00000000032F0000-0x0000000003461000-memory.dmpFilesize
1.4MB