magniber | 3f62866a6d2a6cc143db2780fc933f92994e080c81afc74e0ed97ec272474724

General

Target

System_Update_Win10.4a4793a31463b.dll
Size

73KB
MD5

90a417a2f0b30b3fcd7a958edecc5777
SHA1

590d6273e401526c76b4cbe35393e29f400363ae
SHA256

bc3a0e276a26612ffa45f229b069b624750e2c0737b2af2f934378d85d87a2f9
SHA512

a7466139bbc61bb5c36c1d11958ca6e0e4e4608df25d7f6e7c9afb62a72ccb8d2e78a0bfec0cb4b3942ed697be8111dc66405926f4a0f5cda5d8162396ac93b4
SSDEEP

1536:Awnu+nR6RxOZ46S3CTNqF9NyiBrhcw8FBP:fu+u6y0MLyYh8FZ

Score

10^/10

magniber ransomware

Malware Config

Signatures

Detect magniber ransomware 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4344-132-0x000001D84D7F0000-0x000001D84D7FD000-memory.dmp	family_magniber
behavioral2/memory/2436-133-0x0000021AF9630000-0x0000021AF963B000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Suspicious use of SetThreadContext 12 IoCs

Processes:

rundll32.exe

description	pid	process
PID 4344 set thread context of 0	4344	rundll32.exe
PID 4344 set thread context of 0	4344	rundll32.exe
PID 4344 set thread context of 0	4344	rundll32.exe
PID 4344 set thread context of 0	4344	rundll32.exe
PID 4344 set thread context of 0	4344	rundll32.exe
PID 4344 set thread context of 0	4344	rundll32.exe
PID 4344 set thread context of 0	4344	rundll32.exe
PID 4344 set thread context of 0	4344	rundll32.exe
PID 4344 set thread context of 0	4344	rundll32.exe
PID 4344 set thread context of 0	4344	rundll32.exe
PID 4344 set thread context of 0	4344	rundll32.exe
PID 4344 set thread context of 0	4344	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2708 4344 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4344 rundll32.exe
4344 rundll32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3076 Explorer.EXE

pid	pid_target	process	target process
2708	4344	WerFault.exe	rundll32.exe

pid	process
4344	rundll32.exe
4344	rundll32.exe

pid	process
3076	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

Explorer.EXERuntimeBroker.exe

description	pid	process
Token: SeShutdownPrivilege	3076	Explorer.EXE
Token: SeCreatePagefilePrivilege	3076	Explorer.EXE
Token: SeShutdownPrivilege	3076	Explorer.EXE
Token: SeCreatePagefilePrivilege	3076	Explorer.EXE
Token: SeShutdownPrivilege	3076	Explorer.EXE
Token: SeCreatePagefilePrivilege	3076	Explorer.EXE
Token: SeShutdownPrivilege	3572	RuntimeBroker.exe
Token: SeShutdownPrivilege	3572	RuntimeBroker.exe
Token: SeShutdownPrivilege	3572	RuntimeBroker.exe
Token: SeShutdownPrivilege	3076	Explorer.EXE
Token: SeCreatePagefilePrivilege	3076	Explorer.EXE
Token: SeShutdownPrivilege	3076	Explorer.EXE
Token: SeCreatePagefilePrivilege	3076	Explorer.EXE
Token: SeShutdownPrivilege	3076	Explorer.EXE
Token: SeCreatePagefilePrivilege	3076	Explorer.EXE
Token: SeShutdownPrivilege	3076	Explorer.EXE
Token: SeCreatePagefilePrivilege	3076	Explorer.EXE
Token: SeShutdownPrivilege	3076	Explorer.EXE
Token: SeCreatePagefilePrivilege	3076	Explorer.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4344 wrote to memory of 2436	4344	rundll32.exe	sihost.exe
PID 4344 wrote to memory of 2444	4344	rundll32.exe	svchost.exe
PID 4344 wrote to memory of 2580	4344	rundll32.exe	taskhostw.exe
PID 4344 wrote to memory of 3076	4344	rundll32.exe	Explorer.EXE
PID 4344 wrote to memory of 3216	4344	rundll32.exe	svchost.exe
PID 4344 wrote to memory of 3416	4344	rundll32.exe	DllHost.exe
PID 4344 wrote to memory of 3508	4344	rundll32.exe	StartMenuExperienceHost.exe
PID 4344 wrote to memory of 3572	4344	rundll32.exe	RuntimeBroker.exe
PID 4344 wrote to memory of 3660	4344	rundll32.exe	SearchApp.exe
PID 4344 wrote to memory of 3832	4344	rundll32.exe	RuntimeBroker.exe
PID 4344 wrote to memory of 4604	4344	rundll32.exe	RuntimeBroker.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3076
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System_Update_Win10.4a4793a31463b.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4344 -s 276
    3⤵
    - Program crash
    PID:2708

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3508

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3216

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4604

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3832

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3660

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2444

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2436

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 4344 -ip 4344
1⤵
PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2436-133-0x0000021AF9630000-0x0000021AF963B000-memory.dmp

Filesize
44KB

Download
memory/4344-132-0x000001D84D7F0000-0x000001D84D7FD000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads