magniber | 838ff9687bd425185f43e90f21d6f652538126876fc37bb1ac1f738223910274

General

Target

System_Update_Win10.64267e0e09a43.dll
Size

71KB
MD5

3b0af7a5a1091daaa817ab010f6ac98c
SHA1

da2fb50f474a11bb407a3b6bc59e4e309e04ebc2
SHA256

354f26cc356623d5d099ce3ab1f36821151bb59b3e77521bb903ec1ee3d8f612
SHA512

9e92fbad04090745d7678e16e753d065b07ab8649a0938c7c8ac53558858b00b25f36bd3aec7467c0acde7abff6e7527d5d86a23965c4609a9f80f168a0b373d
SSDEEP

1536:4CMGT+dKdr/XMOgUtFnn3BOVD5yRcUDV++:Xj33t1nw50VT

Score

10^/10

magniber ransomware

Malware Config

Signatures

Detect magniber ransomware 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4440-132-0x00000226D0510000-0x00000226D051C000-memory.dmp	family_magniber
behavioral2/memory/2428-133-0x000001E8B66D0000-0x000001E8B66DB000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Suspicious use of SetThreadContext 13 IoCs

Processes:

rundll32.exe

description	pid	process
PID 4440 set thread context of 0	4440	rundll32.exe
PID 4440 set thread context of 0	4440	rundll32.exe
PID 4440 set thread context of 0	4440	rundll32.exe
PID 4440 set thread context of 0	4440	rundll32.exe
PID 4440 set thread context of 0	4440	rundll32.exe
PID 4440 set thread context of 0	4440	rundll32.exe
PID 4440 set thread context of 0	4440	rundll32.exe
PID 4440 set thread context of 0	4440	rundll32.exe
PID 4440 set thread context of 0	4440	rundll32.exe
PID 4440 set thread context of 0	4440	rundll32.exe
PID 4440 set thread context of 0	4440	rundll32.exe
PID 4440 set thread context of 0	4440	rundll32.exe
PID 4440 set thread context of 0	4440	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4988 4440 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4440 rundll32.exe
4440 rundll32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2664 Explorer.EXE

pid	pid_target	process	target process
4988	4440	WerFault.exe	rundll32.exe

pid	process
4440	rundll32.exe
4440	rundll32.exe

pid	process
2664	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

Explorer.EXERuntimeBroker.exe

description	pid	process
Token: SeShutdownPrivilege	2664	Explorer.EXE
Token: SeCreatePagefilePrivilege	2664	Explorer.EXE
Token: SeShutdownPrivilege	2664	Explorer.EXE
Token: SeCreatePagefilePrivilege	2664	Explorer.EXE
Token: SeShutdownPrivilege	2664	Explorer.EXE
Token: SeCreatePagefilePrivilege	2664	Explorer.EXE
Token: SeShutdownPrivilege	2664	Explorer.EXE
Token: SeCreatePagefilePrivilege	2664	Explorer.EXE
Token: SeShutdownPrivilege	2664	Explorer.EXE
Token: SeCreatePagefilePrivilege	2664	Explorer.EXE
Token: SeShutdownPrivilege	2664	Explorer.EXE
Token: SeCreatePagefilePrivilege	2664	Explorer.EXE
Token: SeShutdownPrivilege	2664	Explorer.EXE
Token: SeCreatePagefilePrivilege	2664	Explorer.EXE
Token: SeShutdownPrivilege	2664	Explorer.EXE
Token: SeCreatePagefilePrivilege	2664	Explorer.EXE
Token: SeShutdownPrivilege	3404	RuntimeBroker.exe
Token: SeShutdownPrivilege	3404	RuntimeBroker.exe
Token: SeShutdownPrivilege	3404	RuntimeBroker.exe
Token: SeShutdownPrivilege	3404	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4440 wrote to memory of 2428	4440	rundll32.exe	sihost.exe
PID 4440 wrote to memory of 2464	4440	rundll32.exe	svchost.exe
PID 4440 wrote to memory of 2588	4440	rundll32.exe	taskhostw.exe
PID 4440 wrote to memory of 2664	4440	rundll32.exe	Explorer.EXE
PID 4440 wrote to memory of 2964	4440	rundll32.exe	svchost.exe
PID 4440 wrote to memory of 3252	4440	rundll32.exe	DllHost.exe
PID 4440 wrote to memory of 3340	4440	rundll32.exe	StartMenuExperienceHost.exe
PID 4440 wrote to memory of 3404	4440	rundll32.exe	RuntimeBroker.exe
PID 4440 wrote to memory of 3504	4440	rundll32.exe	SearchApp.exe
PID 4440 wrote to memory of 3788	4440	rundll32.exe	RuntimeBroker.exe
PID 4440 wrote to memory of 4748	4440	rundll32.exe	RuntimeBroker.exe
PID 4440 wrote to memory of 2356	4440	rundll32.exe	backgroundTaskHost.exe

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2356

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System_Update_Win10.64267e0e09a43.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4440 -s 280
  2⤵
  - Program crash
  PID:4988

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4748

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3788

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3504

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3340

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2964

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2464

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2428

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 4440 -ip 4440
1⤵
PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-133-0x000001E8B66D0000-0x000001E8B66DB000-memory.dmp

Filesize
44KB

Download
memory/3252-146-0x0000021E5D800000-0x0000021E5D808000-memory.dmp

Filesize
32KB

Download
memory/3252-147-0x0000021E5D770000-0x0000021E5D778000-memory.dmp

Filesize
32KB

Download
memory/4440-132-0x00000226D0510000-0x00000226D051C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads