Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 10:13
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe
-
Size
163KB
-
MD5
9668d2e611f840445228d263c7b4149d
-
SHA1
68b6b616bb61b5ea2af89eee21aa4d0023e1299e
-
SHA256
c7bbbfc2195136225d652e33c9b80e6ee4d473561ec25f3965371989f1002d0e
-
SHA512
5c79f369d99e0d38c2bd7a44627bd22d533ccd01f704f6a7a838d67bf51bfd7b314c460a16da9bceffc835a5db8850966aaa9e42778a6db47a3840ff3ac656c4
-
SSDEEP
3072:3r1cWI8i05JurTwXU/ulPgc9qz+9+++++q+l+7:b1RJxur8XMQPgyh+++++q+l+7
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2760 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
winmgr.exewinmgr.exepid process 2468 winmgr.exe 2752 winmgr.exe -
Loads dropped DLL 2 IoCs
Processes:
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exepid process 848 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 848 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe" 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe" 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe -
Drops file in System32 directory 4 IoCs
Processes:
winmgr.exedescription ioc process File opened for modification C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe winmgr.exe File created C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe winmgr.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE winmgr.exe File created C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE winmgr.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exewinmgr.exedescription pid process target process PID 1412 set thread context of 848 1412 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 2468 set thread context of 2752 2468 winmgr.exe winmgr.exe -
Drops file in Windows directory 3 IoCs
Processes:
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exedescription ioc process File created C:\Windows\M-50502979739026720652860250\winmgr.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe File opened for modification C:\Windows\M-50502979739026720652860250\winmgr.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe File opened for modification C:\Windows\M-50502979739026720652860250 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exewinmgr.exedescription pid process target process PID 1412 wrote to memory of 848 1412 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1412 wrote to memory of 848 1412 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1412 wrote to memory of 848 1412 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1412 wrote to memory of 848 1412 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1412 wrote to memory of 848 1412 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1412 wrote to memory of 848 1412 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1412 wrote to memory of 848 1412 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1412 wrote to memory of 848 1412 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1412 wrote to memory of 848 1412 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1412 wrote to memory of 848 1412 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 848 wrote to memory of 2760 848 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe cmd.exe PID 848 wrote to memory of 2760 848 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe cmd.exe PID 848 wrote to memory of 2760 848 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe cmd.exe PID 848 wrote to memory of 2760 848 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe cmd.exe PID 848 wrote to memory of 2468 848 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe winmgr.exe PID 848 wrote to memory of 2468 848 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe winmgr.exe PID 848 wrote to memory of 2468 848 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe winmgr.exe PID 848 wrote to memory of 2468 848 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe winmgr.exe PID 2468 wrote to memory of 2752 2468 winmgr.exe winmgr.exe PID 2468 wrote to memory of 2752 2468 winmgr.exe winmgr.exe PID 2468 wrote to memory of 2752 2468 winmgr.exe winmgr.exe PID 2468 wrote to memory of 2752 2468 winmgr.exe winmgr.exe PID 2468 wrote to memory of 2752 2468 winmgr.exe winmgr.exe PID 2468 wrote to memory of 2752 2468 winmgr.exe winmgr.exe PID 2468 wrote to memory of 2752 2468 winmgr.exe winmgr.exe PID 2468 wrote to memory of 2752 2468 winmgr.exe winmgr.exe PID 2468 wrote to memory of 2752 2468 winmgr.exe winmgr.exe PID 2468 wrote to memory of 2752 2468 winmgr.exe winmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe"2⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\lhkddwgeqx.bat" "3⤵
- Deletes itself
-
C:\Windows\M-50502979739026720652860250\winmgr.exeC:\Windows\M-50502979739026720652860250\winmgr.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\M-50502979739026720652860250\winmgr.exeC:\Windows\M-50502979739026720652860250\winmgr.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lhkddwgeqx.batFilesize
278B
MD548ab1ef9b268308494ea4452b5a02ed9
SHA15a0c926a3605a5ff564b561a268e04d71016fb5c
SHA2560ffd617bbd524f199e9ff0a5b85bdfe4cdfffceb988893dfa002c816bc45be88
SHA5127d757f85cca6939ac17692c0a784ddea0016227063b854d6c97ecb35d8ce35d84e2994fcbb3bc71c2568a508e569758a5a22cb05a89e25d0c82ccd5ef295a804
-
C:\Windows\M-50502979739026720652860250\winmgr.exeFilesize
163KB
MD59668d2e611f840445228d263c7b4149d
SHA168b6b616bb61b5ea2af89eee21aa4d0023e1299e
SHA256c7bbbfc2195136225d652e33c9b80e6ee4d473561ec25f3965371989f1002d0e
SHA5125c79f369d99e0d38c2bd7a44627bd22d533ccd01f704f6a7a838d67bf51bfd7b314c460a16da9bceffc835a5db8850966aaa9e42778a6db47a3840ff3ac656c4
-
memory/848-9-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/848-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/848-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/848-8-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1412-6-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1412-0-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1412-2-0x0000000000510000-0x0000000000610000-memory.dmpFilesize
1024KB
-
memory/2468-29-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2468-32-0x00000000004A0000-0x00000000005A0000-memory.dmpFilesize
1024KB
-
memory/2468-39-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2752-42-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2752-47-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2752-49-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2752-52-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2752-55-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2752-57-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2752-66-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB