3d61202f9e3cc3c033bfee04ce1ad74f734aac24aeb4f72a6611b6db46f08d43 | Triage

Sharing

General

Target

2024-03-26_d5a43b4aafb075f95106e57de2b7ecf4_magniber
Size

151KB
Sample

240326-dhjqgafb5x
MD5

d5a43b4aafb075f95106e57de2b7ecf4
SHA1

44fd1ab2d88ccf4cc68c9ea0eb5caea5e2e72721
SHA256

3d61202f9e3cc3c033bfee04ce1ad74f734aac24aeb4f72a6611b6db46f08d43
SHA512

bba6c42de21af442b7de4482a2542bfc593394e79ff55c066332e30b2dd21f4f736a60fb0d9461e174d7f04f796bfd6130cab13965fce2751cadbc805cebcb57
SSDEEP

1536:lVwvLO1zPAihVLrdrbUkgtwYRvKWzXzpa5JF7ErTwXHE24iS333ulpiNIgmBzNMT:3r1cWI8i05JurTwXU/ulPgc9qz+9+++7

Score

10^/10

evasion persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-03-26_d5a43b4aafb075f95106e57de2b7ecf4_magniber
- Size
  
  151KB
- MD5
  
  d5a43b4aafb075f95106e57de2b7ecf4
- SHA1
  
  44fd1ab2d88ccf4cc68c9ea0eb5caea5e2e72721
- SHA256
  
  3d61202f9e3cc3c033bfee04ce1ad74f734aac24aeb4f72a6611b6db46f08d43
- SHA512
  
  bba6c42de21af442b7de4482a2542bfc593394e79ff55c066332e30b2dd21f4f736a60fb0d9461e174d7f04f796bfd6130cab13965fce2751cadbc805cebcb57
- SSDEEP
  
  1536:lVwvLO1zPAihVLrdrbUkgtwYRvKWzXzpa5JF7ErTwXHE24iS333ulpiNIgmBzNMT:3r1cWI8i05JurTwXU/ulPgc9qz+9+++7
Score

10^/10

evasion persistence spyware stealer
- Modifies security service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencespywarestealer

behavioral2