Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 10:13
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe
-
Size
163KB
-
MD5
9668d2e611f840445228d263c7b4149d
-
SHA1
68b6b616bb61b5ea2af89eee21aa4d0023e1299e
-
SHA256
c7bbbfc2195136225d652e33c9b80e6ee4d473561ec25f3965371989f1002d0e
-
SHA512
5c79f369d99e0d38c2bd7a44627bd22d533ccd01f704f6a7a838d67bf51bfd7b314c460a16da9bceffc835a5db8850966aaa9e42778a6db47a3840ff3ac656c4
-
SSDEEP
3072:3r1cWI8i05JurTwXU/ulPgc9qz+9+++++q+l+7:b1RJxur8XMQPgyh+++++q+l+7
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe -
Executes dropped EXE 2 IoCs
Processes:
winmgr.exewinmgr.exepid process 2480 winmgr.exe 2328 winmgr.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe" 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe" 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exewinmgr.exedescription pid process target process PID 1096 set thread context of 3584 1096 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 2480 set thread context of 2328 2480 winmgr.exe winmgr.exe -
Drops file in Program Files directory 8 IoCs
Processes:
winmgr.exedescription ioc process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll winmgr.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe winmgr.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe winmgr.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll winmgr.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll winmgr.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe winmgr.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe winmgr.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll winmgr.exe -
Drops file in Windows directory 3 IoCs
Processes:
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exedescription ioc process File created C:\Windows\M-50502979739026720652860250\winmgr.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe File opened for modification C:\Windows\M-50502979739026720652860250\winmgr.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe File opened for modification C:\Windows\M-50502979739026720652860250 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exewinmgr.exedescription pid process target process PID 1096 wrote to memory of 3584 1096 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1096 wrote to memory of 3584 1096 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1096 wrote to memory of 3584 1096 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1096 wrote to memory of 3584 1096 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1096 wrote to memory of 3584 1096 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1096 wrote to memory of 3584 1096 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1096 wrote to memory of 3584 1096 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1096 wrote to memory of 3584 1096 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 1096 wrote to memory of 3584 1096 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe PID 3584 wrote to memory of 1376 3584 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe cmd.exe PID 3584 wrote to memory of 1376 3584 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe cmd.exe PID 3584 wrote to memory of 1376 3584 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe cmd.exe PID 3584 wrote to memory of 2480 3584 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe winmgr.exe PID 3584 wrote to memory of 2480 3584 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe winmgr.exe PID 3584 wrote to memory of 2480 3584 2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe winmgr.exe PID 2480 wrote to memory of 2328 2480 winmgr.exe winmgr.exe PID 2480 wrote to memory of 2328 2480 winmgr.exe winmgr.exe PID 2480 wrote to memory of 2328 2480 winmgr.exe winmgr.exe PID 2480 wrote to memory of 2328 2480 winmgr.exe winmgr.exe PID 2480 wrote to memory of 2328 2480 winmgr.exe winmgr.exe PID 2480 wrote to memory of 2328 2480 winmgr.exe winmgr.exe PID 2480 wrote to memory of 2328 2480 winmgr.exe winmgr.exe PID 2480 wrote to memory of 2328 2480 winmgr.exe winmgr.exe PID 2480 wrote to memory of 2328 2480 winmgr.exe winmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_9668d2e611f840445228d263c7b4149d_magniber.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sspokqxqqc.bat" "3⤵
-
C:\Windows\M-50502979739026720652860250\winmgr.exeC:\Windows\M-50502979739026720652860250\winmgr.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\M-50502979739026720652860250\winmgr.exeC:\Windows\M-50502979739026720652860250\winmgr.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\sspokqxqqc.batFilesize
278B
MD5ba4873b38320c26c8ecf21943c3f29be
SHA16eafe25745501864e12850b50d2b4bfdc04882fb
SHA25652ee0aeb2ccc4cd585fb30f47e8f2567c508d8bb071180405b5d115ad07076b6
SHA51202550266ddc80a0458f602f6676e73348582025fa8e069a2781d4cf34433e78ccc5d773eab3135199248212c33f8db864f53711b31ec426d3c3b54f07c8ab46f
-
C:\Windows\M-50502979739026720652860250\winmgr.exeFilesize
163KB
MD59668d2e611f840445228d263c7b4149d
SHA168b6b616bb61b5ea2af89eee21aa4d0023e1299e
SHA256c7bbbfc2195136225d652e33c9b80e6ee4d473561ec25f3965371989f1002d0e
SHA5125c79f369d99e0d38c2bd7a44627bd22d533ccd01f704f6a7a838d67bf51bfd7b314c460a16da9bceffc835a5db8850966aaa9e42778a6db47a3840ff3ac656c4
-
memory/1096-2-0x0000000000530000-0x0000000000630000-memory.dmpFilesize
1024KB
-
memory/1096-0-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1096-5-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2328-64-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2328-63-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2328-56-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2328-46-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2328-47-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2328-66-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2328-26-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2328-27-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2328-29-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2328-39-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2328-40-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2480-24-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2480-21-0x00000000006B0000-0x00000000007B0000-memory.dmpFilesize
1024KB
-
memory/2480-17-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3584-7-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3584-6-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3584-3-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB