Static task
static1
Behavioral task
behavioral1
Sample
Magnus Night V3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Magnus Night V3.exe
Resource
win10v2004-20231215-en
General
-
Target
Magnus Night V3.exe
-
Size
1.8MB
-
MD5
ca4cb3238184c34f08c0b602b2ec988f
-
SHA1
ad3af158ece0f325a7d7c1c8da83234287a728f6
-
SHA256
d4df7dd833b7032b24902995ab28c25f9a11321f85b559fdd1d48883fcda5698
-
SHA512
65e1b102d8d916011767db6aebb67295d15ed1326068b7b43f968c53962572c6a7a08bc8e68ebae507fb825c8ba6a62f088db924032675589233fb2451e4c7bb
-
SSDEEP
24576:Qi6HPyk7VAFtjeU3u9ykVcrH9DMjWbYU9JOA4LsRLb38hildl3mmx1DvaTlIpfZ7:t7WYCMqgz95p4oLbZnlzlvFZ2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Magnus Night V3.exe
Files
-
Magnus Night V3.exe.exe windows:6 windows x64 arch:x64
118584b75de12419d7d54bd11e339a8c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSACleanup
closesocket
inet_pton
WSAStartup
send
socket
connect
recv
htons
kernel32
LocalAlloc
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
LocalFree
FreeLibrary
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
SetConsoleTitleA
FindNextFileW
SetConsoleMode
GetCurrentProcessId
SetUnhandledExceptionFilter
WideCharToMultiByte
ReadProcessMemory
CreateProcessA
VirtualQueryEx
GetCurrentProcess
CreateFileW
GetCurrentThreadId
LoadLibraryW
RtlVirtualUnwind
FindFirstFileExW
FindFirstFileW
FindClose
GetLocaleInfoEx
GetStdHandle
FormatMessageA
GetFileAttributesExW
GetSystemTimeAsFileTime
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
InitializeSListHead
IsDebuggerPresent
QueryPerformanceCounter
RtlCaptureContext
MultiByteToWideChar
GetFileInformationByHandleEx
GetModuleHandleW
GetLastError
AreFileApisANSI
RtlLookupFunctionEntry
advapi32
AllocateAndInitializeSid
AddAccessDeniedAce
FreeSid
InitializeSecurityDescriptor
InitializeAcl
SetKernelObjectSecurity
GetLengthSid
SetSecurityDescriptorDacl
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
msvcp140
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
_Query_perf_frequency
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?_Random_device@std@@YAIXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
__C_specific_handler
memset
memmove
memcpy
__current_exception_context
__std_type_info_compare
__std_terminate
__std_exception_copy
__std_exception_destroy
memchr
_CxxThrowException
memcmp
__std_type_info_name
api-ms-win-crt-runtime-l1-1-0
_initterm_e
exit
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm
terminate
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_get_initial_narrow_environment
_errno
_exit
api-ms-win-crt-string-l1-1-0
_wcsicmp
tolower
toupper
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
fsetpos
ungetc
setvbuf
fgetpos
_get_stream_buffer_pointers
fwrite
__stdio_common_vsprintf_s
fread
fgetc
__p__commode
fclose
fflush
fputc
__stdio_common_vsprintf
__stdio_common_vfprintf
_set_fmode
__acrt_iob_func
_fseeki64
api-ms-win-crt-convert-l1-1-0
strtol
strtoll
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
pow
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 259KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 400B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ