Overview

overview

7

Static

static

1

2024-02-03...er.exe

windows7-x64

7

2024-02-03...er.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-02-2024 04:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-02-03_6cd1d2e97532ba4b38930fdb67cc0e36_mafia_magniber.exe

  • Size

    7.3MB

  • MD5

    6cd1d2e97532ba4b38930fdb67cc0e36

  • SHA1

    9c79f624643117c71cdcd8203b2bd530339dd3c4

  • SHA256

    86812eaf4cfc634f78fc757e5bd92a1562679f892a4c3afe87c673bc2d3dfa2e

  • SHA512

    271cbe2c8a88f0b8935b831541e97996596eee31b976759e85dc9bbf7bfc0aef89836e7538ce73c245d451eed86322732d44ab8b77e592f7ddd906e65a2199d3

  • SSDEEP

    196608:FEthOxzH3FY4gA/yN8eA+QDt3BcE24PJP1ruUl:FEKzH1YPAJ/5B+4XZl

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-03_6cd1d2e97532ba4b38930fdb67cc0e36_mafia_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-03_6cd1d2e97532ba4b38930fdb67cc0e36_mafia_magniber.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\quartz.dll"
      2⤵
      • Modifies registry class
      PID:1292
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /u /s "C:\Program Files (x86)\Funshion Online\2.8.6.75\funoictl.dll"
      2⤵
        PID:2416

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\SetupFiles\Funshion\gma.dll
      Filesize

      484KB

      MD5

      62266ab38841a6161ed3680553b44c4c

      SHA1

      ee1f981e1ffb3c234ddf06643b26cd24d46556f5

      SHA256

      ca8b14774d35c88115417154411e70fbe5c6677fee77f059fbd236b36f0cba0e

      SHA512

      b82327aa29dd2a7f97867aaa91c821094d94495e8364aceef71e957e84eeec9a1b259cb51be68df330adbe2ed6b7f8fc4ea7816abb120a4ae4be3bd548732321

      Download Submit

    • C:\Users\Admin\funshion.ini
      Filesize

      108B

      MD5

      9d04714bbeb535afdec3241f6ebde960

      SHA1

      ec00dcd74db3c64ad9f8dc461c2ab0c4959382c9

      SHA256

      5a493f797fb4ff5307b5064f0aac741a40875614377b2fce82143adec765216a

      SHA512

      8652ed94cb4b9f2a64a35f6eb1fac6ccc4bb8ac238f4af02b5191d742090ff561b4481a47bc84761c665662b9523a120186eb08844ff2777817ba958a08a88ca

      Download Submit

    • C:\Windows\SysWOW64\funshion.ini
      Filesize

      37B

      MD5

      2ea4451d2bf7de019dd5e92341c94660

      SHA1

      ec5817fbdfe097aadd9bfa26bea6195310162beb

      SHA256

      b6f729f1e203f8065a783c9b6d5a4cb9e84f42228c4ab28869f26af003fcdc22

      SHA512

      10c11ce16a8d22b22814513282a3fce9b0ce3499e3f04bc5d41fe9d0ee784ecddd974a262c706edcc0fc3b9744118d88f0b05598213822629ccd105a7c8182a3

      Download Submit