magniber | 354f26cc356623d5d099ce3ab1f36821151bb59b3e77521bb903ec1ee3d8f612

General

Target

System_Update_Win10.64267e0e09a43.cpl.dll
Size

71KB
MD5

3b0af7a5a1091daaa817ab010f6ac98c
SHA1

da2fb50f474a11bb407a3b6bc59e4e309e04ebc2
SHA256

354f26cc356623d5d099ce3ab1f36821151bb59b3e77521bb903ec1ee3d8f612
SHA512

9e92fbad04090745d7678e16e753d065b07ab8649a0938c7c8ac53558858b00b25f36bd3aec7467c0acde7abff6e7527d5d86a23965c4609a9f80f168a0b373d
SSDEEP

1536:4CMGT+dKdr/XMOgUtFnn3BOVD5yRcUDV++:Xj33t1nw50VT

Score

10^/10

magniber ransomware

Malware Config

Signatures

Detect magniber ransomware 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1484-132-0x000001DEFE980000-0x000001DEFE98C000-memory.dmp	family_magniber
behavioral2/memory/2356-133-0x000001A77D150000-0x000001A77D15B000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Suspicious use of SetThreadContext 12 IoCs

Processes:

rundll32.exe

description	pid	process
PID 1484 set thread context of 0	1484	rundll32.exe
PID 1484 set thread context of 0	1484	rundll32.exe
PID 1484 set thread context of 0	1484	rundll32.exe
PID 1484 set thread context of 0	1484	rundll32.exe
PID 1484 set thread context of 0	1484	rundll32.exe
PID 1484 set thread context of 0	1484	rundll32.exe
PID 1484 set thread context of 0	1484	rundll32.exe
PID 1484 set thread context of 0	1484	rundll32.exe
PID 1484 set thread context of 0	1484	rundll32.exe
PID 1484 set thread context of 0	1484	rundll32.exe
PID 1484 set thread context of 0	1484	rundll32.exe
PID 1484 set thread context of 0	1484	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1968 1484 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1484 rundll32.exe
1484 rundll32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2980 Explorer.EXE

pid	pid_target	process	target process
1968	1484	WerFault.exe	rundll32.exe

pid	process
1484	rundll32.exe
1484	rundll32.exe

pid	process
2980	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

Explorer.EXERuntimeBroker.exe

description	pid	process
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	2980	Explorer.EXE
Token: SeCreatePagefilePrivilege	2980	Explorer.EXE
Token: SeShutdownPrivilege	3456	RuntimeBroker.exe
Token: SeShutdownPrivilege	3456	RuntimeBroker.exe
Token: SeShutdownPrivilege	3456	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1484 wrote to memory of 2356	1484	rundll32.exe	sihost.exe
PID 1484 wrote to memory of 2376	1484	rundll32.exe	svchost.exe
PID 1484 wrote to memory of 2448	1484	rundll32.exe	taskhostw.exe
PID 1484 wrote to memory of 2980	1484	rundll32.exe	Explorer.EXE
PID 1484 wrote to memory of 3092	1484	rundll32.exe	svchost.exe
PID 1484 wrote to memory of 3292	1484	rundll32.exe	DllHost.exe
PID 1484 wrote to memory of 3384	1484	rundll32.exe	StartMenuExperienceHost.exe
PID 1484 wrote to memory of 3456	1484	rundll32.exe	RuntimeBroker.exe
PID 1484 wrote to memory of 3548	1484	rundll32.exe	SearchApp.exe
PID 1484 wrote to memory of 3776	1484	rundll32.exe	RuntimeBroker.exe
PID 1484 wrote to memory of 4708	1484	rundll32.exe	RuntimeBroker.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2376

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3092

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4708

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3776

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3548

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3384

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3292

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2980
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System_Update_Win10.64267e0e09a43.cpl.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1484 -s 276
    3⤵
    - Program crash
    PID:1968

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 464 -p 1484 -ip 1484
1⤵
PID:4844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1484-132-0x000001DEFE980000-0x000001DEFE98C000-memory.dmp

Filesize
48KB

Download
memory/2356-133-0x000001A77D150000-0x000001A77D15B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads