Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 04:52

General

  • Target

    2024-04-28_e3e53d015bf224904f16f6602f87ca70_magniber.exe

  • Size

    8.8MB

  • MD5

    e3e53d015bf224904f16f6602f87ca70

  • SHA1

    83bc53c80d6c43611f0b3a16863da8e22de78b5b

  • SHA256

    a34b0567360467e86bf591c8a241bea2299bddb09dfc9e1b18f0f2ed1402ed40

  • SHA512

    c92dae60317625d39dc8b0502339fe612e11bb2ea9af7d8ff65d11850e1b5a30d4850597f0a2ef1b82008b919cc5f8ba8869f651554177e67f4951274201b6e8

  • SSDEEP

    98304:qmCMLyAw3LNIsVqygGP0w1sBJ1QttoFCqkKq7NO55f0pmsOWrqufezvWq/vUv2Tz:WJBILX6svTCZWfFWrqufezvWqHUg

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 15 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 62 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-28_e3e53d015bf224904f16f6602f87ca70_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-28_e3e53d015bf224904f16f6602f87ca70_magniber.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2292
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 71AA81CC9FA4462453CE96DC002E54B6
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2716
      • C:\Users\Admin\AppData\Local\Temp\21C01394-915A-411E-84DB-E340D71642F5\lite_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\21C01394-915A-411E-84DB-E340D71642F5\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1364
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 99D0963127E9AD176ED94EB224B1DBF5 M Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:640
      • C:\Users\Admin\AppData\Local\Temp\74D0E9C5-35B5-4AB1-8F5F-280A20791C28\seederexe.exe
        "C:\Users\Admin\AppData\Local\Temp\74D0E9C5-35B5-4AB1-8F5F-280A20791C28\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--locale=us" "--browser=" "--browser_default=" "--yabm=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\D53EE7CA-55DF-476F-A5C6-A47D5492AAF3\sender.exe" "--is_elevated=yes" "--ui_level=5"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies Internet Explorer settings
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1988
        • C:\Users\Admin\AppData\Local\Temp\D53EE7CA-55DF-476F-A5C6-A47D5492AAF3\sender.exe
          C:\Users\Admin\AppData\Local\Temp\D53EE7CA-55DF-476F-A5C6-A47D5492AAF3\sender.exe --send "/status.xml?clid=2313438&uuid=%7B76E27555-A8BA-4DE6-9DCC-1F2EDED1CDB8%7D&vnt=Windows 7x64&file-no=6%0A15%0A25%0A37%0A38%0A45%0A57%0A59%0A106%0A108%0A111%0A129%0A"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:3720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f761cb6.rbs

    Filesize

    591B

    MD5

    748db35d0ad5ef0db336aabe0359f9e6

    SHA1

    8877a90780860f8640d11a5ac47b14df850a90d4

    SHA256

    bc3bee5d1ea511daca1709b8732e528be3bfc8727d52711097ad36b395dfc12f

    SHA512

    a7b5997703844bdd202d1153856f1eadf41649766519b1b7a17df5b0299f4af065477777c0490725d086911c2788737d897b072f81445d037e25ae74fa9b68c2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A026C9CD7BA14377D055F4A2325D4501

    Filesize

    1KB

    MD5

    d51332c4498a42803274c8934d94c9d9

    SHA1

    c74338351316938b5b74467e7574e7dce8f3772e

    SHA256

    e241e6464c543009cd33ee42d029e6e3dab9770c37fd313c415736ce8881bb58

    SHA512

    10aeb818f56a839a25a5bcea15fe2c924e631a25b64978b3995e0d96ad0f20c2eb1543ed17c59285b7267f8ac2b7b692deeada04c683cd2f4bb16db40a379f65

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B0B1E3C3B1330A269DBEE4BA6313E7B4

    Filesize

    1KB

    MD5

    2ffbdb98df2a2b022a48adeb94a3af50

    SHA1

    6c86923b5c5832bb102f041cb7d38db397074f12

    SHA256

    dd12c5733bc4b682e1da6353c8c27650f53d11a8ada8fd8a2d06f23cecae5ebd

    SHA512

    a5f29661ac78ea205dd945fcc53e015152277426af4bcce688231ca1a564dc49144b2953409651737733fec72e9042468c780917543c007d7de74ed44058dbfb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDA81A73291E20E6ACF6CACA76D5C942_4EA93225B46C4B45501FF0DDE9E306D0

    Filesize

    5B

    MD5

    5bfa51f3a417b98e7443eca90fc94703

    SHA1

    8c015d80b8a23f780bdd215dc842b0f5551f63bd

    SHA256

    bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

    SHA512

    4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A026C9CD7BA14377D055F4A2325D4501

    Filesize

    508B

    MD5

    ad0b42d3477dd54cb73fa3fd1484d5cc

    SHA1

    53f0fc220a05a738e86d515b695b68d178f1fa43

    SHA256

    92ae0618f04b4ed7fb4dc70359d94a7bbd04df87b2720c795071bc94e85a1857

    SHA512

    63e9e0e97a8a3c9627d3acaa755899527039c619547789e848c6d92165666068ddd9983a29f1b2c822f1f2cce032aff2d1abc411fe8b11f913367ce704a6c86f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5d5b1e0c3e030b2b4f9f476d440defc6

    SHA1

    f9979914237a83a9211a9c4439172aa8b4446037

    SHA256

    8f962eded27f6a4344d62440b1e5c5f3bbf9fc8425910f561882cbdf1042750c

    SHA512

    db0a41a88f8a9644573b02fb22b7e0187f8972dce439f436289e4727a25e4613687151b5d9c4753f72169613a86b13f4b0347ad7a7edf9686b456dc81eaa4d84

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B0B1E3C3B1330A269DBEE4BA6313E7B4

    Filesize

    208B

    MD5

    72ae1478662b2ef5e181a6b6528f959f

    SHA1

    7eb3fad19713b6b43ceaf7114a7c0b194eed913f

    SHA256

    5f72e388aa9bc6fce3a4baed3c23203ee04c1b2ada3495b4730eb79b4b1e9f7d

    SHA512

    2771929456b43ab20fc0ff292c2ca5b76f9ed8f4b64361fdb776077b3e93f67653ee96bc836abb3b8ec380190dc7ff9a518084f4730890f6b722027ba4b521f4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDA81A73291E20E6ACF6CACA76D5C942_4EA93225B46C4B45501FF0DDE9E306D0

    Filesize

    440B

    MD5

    0d977b655eb26503a0a455e33a754dd5

    SHA1

    2eefe3868a2054ac4f6f89e2a9fc01fd641593de

    SHA256

    301d27cee2434669944fcb12ad9c62bce213905021c8df53d3ae61c8e7e13871

    SHA512

    2bad8d0e775aafc8060ef2c450c9a5d6afb848bd90fc7910fbb2f9f2ba590473c29f594e41cb7cfc91c79db55b2388f7a461aa0188254342954f795c268b1088

  • C:\Users\Admin\AppData\Local\Temp\Cab1E2B.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\OMNIJA~1.ZIP

    Filesize

    41.3MB

    MD5

    1d6cfd7db58008d1b44328c5a3a4220c

    SHA1

    8e8304bfd7a73b9ae8415b6cbd273e612868a2b2

    SHA256

    915e46dcc29d6fee123c4b8e88d846ac95ffd4a6f4eb956dc882d305ee1b8256

    SHA512

    4c17160aa83abeff897462f981226902dd6694817ad95f246511fc63c637bdffa0989a3db00c4309fa673a13b4993c509df538ddad482d1be8b4058749ee93f2

  • C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log

    Filesize

    34KB

    MD5

    f480db9c119956ff54fa511b018b0b0f

    SHA1

    e6558fee199e27974d5b4ecd060abf43f6b566d6

    SHA256

    fbe041e2683d67f54c74e70ae42a01f79afa26b41cb866a6f3da9e00211b363e

    SHA512

    3083ed69cabb1243da8ee9492dc1098baf5715bae64aa375caed38a8708b3111add2115e1db48fea676892a35f54c9b2c0fb1075254e3992c0051260c7b81247

  • C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml

    Filesize

    529B

    MD5

    43b45c945e9cb002e54ec75b7995b9a8

    SHA1

    38736aa2cc0b36c7451748607003aebb6abd268e

    SHA256

    d912a64429c9ab34949ef7288ecfcc6211b1b31e5aac3eb60073c8c1aa78a3b4

    SHA512

    4281367164a1aead1a5ed6030286f92310493c8be7cf50460097d2082c1429a174b0693f197c5bb80593beedb72b702d8ce31463f844f6399a3bf3662f7931f0

  • C:\Users\Admin\AppData\Local\Temp\vendor00000.xml

    Filesize

    508B

    MD5

    54e4b8032d028b7956e07b2d7363fb32

    SHA1

    8ab03847257cca80f4afc2c03753198f707c7d15

    SHA256

    3d2889b15326ab15f7dff1652e886dab59a18a474d47d38775ccbe0887aa13fd

    SHA512

    c214728af961d66647583f2b753d97b38f9dc9d162e92d10c44d46fd4ef05c9ae6366190ac681f0f62e2f387dd6c592d845323edee5a704a4e9533387464d6a2

  • C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi

    Filesize

    8.5MB

    MD5

    8c271d838375d560c35df3427cfcc972

    SHA1

    e953969b0a5acd08eec15ffd861299f92a6748ca

    SHA256

    b8f95360b616b0e5d26377eaa7fa657519ef96caee32edc10f86494d2924ed2f

    SHA512

    c92ee711371060c17e6781e8bad175fa7c1a82ad0b0e3df5a45ad852f7bf3f6a130de5475b907badd3decb5f1896eff8efa49b07a363ae03157bc327361128e9

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.Admin\places.sqlite-2024532808.658000658.backup

    Filesize

    68KB

    MD5

    d57cd95de07d3b15eb5cf8baa80471af

    SHA1

    322c0e13f2022ab255a8d2a50c5835779b6ccc3e

    SHA256

    651efdc8961efbf6476e4cc4b3965a4da72690ebedda009fd800c6d936a67696

    SHA512

    2e98256a9e76ae384f88b83075a321f60cb13ee6f7e8cb93f1919103b82ba79a67b5eec8a7d3043fe26b377fae58545e82323813897c0e67adfacaa885d6f68e

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\extensions\staged\[email protected]

    Filesize

    1KB

    MD5

    5a40649cf7f6923e1e00e67a8e5fc6c8

    SHA1

    fc849b64b31f2b3d955f0cb205db6921eacc1b53

    SHA256

    6d432ba7096090837f9533a33a686c846ad67aed8ecc43af7ce8af42649cd51a

    SHA512

    0fc42a2cc61528b14478f4b9ae098ea90e6b05ddbe10f3a6cdd6326d0d8e6185b49d2b8143b76a9f329bdc277cf02b54d98f374edd65df68a1ffc41e1c817786

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\extensions\staged\[email protected]

    Filesize

    688KB

    MD5

    ab6d42f949df8d7e6a48c07e9b0d86e0

    SHA1

    1830399574b1973e2272e5dcc368c4c10dbbe06b

    SHA256

    205ebf52c47b42fa0ad1a734a1d882d96b567e15a32b19bdb907562db8ea09e2

    SHA512

    6c4f9bb726384c87b6523e08339f7821ad4ec8717b26db902ca51df74eb89b46e4ded1504a131683b07b2bba3e6e911a549a8a83b2aad3971047c0fe315a1ad5

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\extensions\staged\[email protected]

    Filesize

    5KB

    MD5

    856242624386f56874a3f3e71d7993f4

    SHA1

    96d3199c5eebb0d48c944050fbc753535ee09801

    SHA256

    d86ed80d2a9e4e1af843a991a6553a2fefd5433b2144be0cfb63a2f18deb86be

    SHA512

    76d440fe2ed535677a1d249b289463bfedfc5d2afc0e269e4593bb113393f165856c07117735cf3e5a230b5d04a61c7126df24a466594d8c27b47b2047834a09

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9bot8sq2.default-release\extensions\staged\[email protected]

    Filesize

    1.7MB

    MD5

    e68cea8c6d4b16641f30dd930a952ebb

    SHA1

    7e8c4b51e6e56f35a2983ab6cb121341aeda565c

    SHA256

    a7f3f788323a12158d66f341c4711d71fc2244a2b07a68fb8df4baec0ff76f35

    SHA512

    96351e36a4c5020ed464b96b72bb3063db819981440bde7c6c3a50f7fe470e1d70f0350ec7c4bcd4808fcabe2ddfbdebfc7039ae2248c1455e2245f53ce44ec0

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-2024532808.782800782.backup

    Filesize

    1KB

    MD5

    3adec702d4472e3252ca8b58af62247c

    SHA1

    35d1d2f90b80dca80ad398f411c93fe8aef07435

    SHA256

    2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335

    SHA512

    7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-2024532808.782800782.backup

    Filesize

    313B

    MD5

    af006f1bcc57b11c3478be8babc036a8

    SHA1

    c3bb4fa8c905565ca6a1f218e39fe7494910891e

    SHA256

    ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c

    SHA512

    3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af

  • C:\Users\Admin\AppData\Roaming\Yandex\ui

    Filesize

    38B

    MD5

    ee1bcbc3d32861a0aae5fdee3b906db8

    SHA1

    b3cf64e6bc6edce30fc08ecdb52c652ecfcedcd0

    SHA256

    dac359f94f1d71d36878348f60fe1791a75cea663c1e794b5d23931aac298220

    SHA512

    e017bbe1514abf4d9433a495da15b92c777364a59f5cc1fde977130ae4288578f8ab101579f41c6cafdde8b0f6a019c38900da448b8cf1d6a3b988dcbe1ca26d

  • C:\Windows\Installer\MSI1EB9.tmp

    Filesize

    172KB

    MD5

    694a088ff8fa0e3155881bb6500868bc

    SHA1

    096626661b9bcb3b3197b92e7e3c4e77ad4b2df4

    SHA256

    6f3a5bbd29f669712d6c2c7e5174dea6807cb86fda293acbe360bde81d29a633

    SHA512

    bd3a9cdf9ea591d462be8e00e9bc44c391897c40d598ada19f0377f3a6aea97aba03627d97d6362edbb81763fe3c7570d07bdfd5a004dd9e7af4531bc490bdeb

  • C:\Windows\Installer\MSI1EF9.tmp

    Filesize

    189KB

    MD5

    c3a831564e7b54fb7b502b728e232542

    SHA1

    82a4f969b1f19dc6489e13d357ccad9fef4837ab

    SHA256

    43097d66f86e3a1103d4cc7c410e46daba8d1a7a991ab6c222d41bd2620c19ca

    SHA512

    4855ca4429974a0b111d42b86cb8f89188310aaaf9174b4cf462a968163c8b92e38d4a519c78133301b341be5cd02e34b55b55575e84f0d01c2cd11ae74cce05

  • C:\Windows\Installer\MSI21A0.tmp

    Filesize

    202KB

    MD5

    ba84dd4e0c1408828ccc1de09f585eda

    SHA1

    e8e10065d479f8f591b9885ea8487bc673301298

    SHA256

    3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

    SHA512

    7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

  • \Users\Admin\AppData\Local\Temp\21C01394-915A-411E-84DB-E340D71642F5\lite_installer.exe

    Filesize

    390KB

    MD5

    28b10eff9b78787aa18e424fd9319064

    SHA1

    0bd2bc3665e8988567607460ea6bfc51d45d4d5c

    SHA256

    dbbbf54115fb97f777180f67ee341cf16803ed6e85bf9af60ea13d9b99be362d

    SHA512

    a908a231c9db21767066ab13ec4a8ac451bc978f5d8bccf5032e5ecbcaa996c7e2afff0121036cc184a3c19a4caf542bb15dbe6ad6dae16c422f6ac6bc5a791a

  • \Users\Admin\AppData\Local\Temp\74D0E9C5-35B5-4AB1-8F5F-280A20791C28\seederexe.exe

    Filesize

    6.8MB

    MD5

    6df2e368846222aef04e596d9ea43aac

    SHA1

    57b59e1002d9d971fc504df0493d5ac54380027b

    SHA256

    f4adf79355ff21c11faf8283d06e28013478834a64d9473d27194f4dbcfed359

    SHA512

    a40636178285fa12b1b6f99802fdfd3b569c674b1864f5c6893ccb6a48c90232539704da8ea478457ead39c1f94c319467b41142c8aa26473a280c4fb329f662

  • \Users\Admin\AppData\Local\Temp\D53EE7CA-55DF-476F-A5C6-A47D5492AAF3\sender.exe

    Filesize

    249KB

    MD5

    4ce9460ed83b599b1176c4161e0e5816

    SHA1

    ca1bd4f28ec3e6f4b0253764e6339e480d3549bd

    SHA256

    118d277f46df036ffb1ca69d9da7890c65c3807a6e88248f3ba703b0f51cd308

    SHA512

    1064da56e85d3b0c34c47e9fa0821b2ceb79e338e602e705b7f801c0a1bfb83246c340fa1351fc222216a12968bcc52540e105f186a3ef6f3e7c32348936daf3