9d06d05f13a917cfc9d26f15aec8fc73482bdb77af762981ed8d38ae4456fa7a

General

Target

2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
Size

163KB
MD5

2132e25ee51252d3647030b6f6b75d5e
SHA1

aa7f9955779d63b2feaaa737a596a21a8b4a63f3
SHA256

9d06d05f13a917cfc9d26f15aec8fc73482bdb77af762981ed8d38ae4456fa7a
SHA512

e148bbeb047cffd2df991256efa7728509bce09b4f6df2f78efdad4bb74d0282e1f3612f34fbce25bd080f0823d88e4890eb6a768d69bc171ca5ad5a0f5de84b
SSDEEP

3072:3r1cWI8i05JurTwXU/ulPgc9qz+9+++++++qG7:b1RJxur8XMQPgyh+++++++qG7

Score

10^/10

evasion persistence spyware stealer

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2076 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

winmgr.exewinmgr.exe

pid process

2288 winmgr.exe
2668 winmgr.exe
Loads dropped DLL 3 IoCs

Processes:

2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exewinmgr.exe

pid process

2164 2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
2164 2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
2288 winmgr.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2076	cmd.exe

pid	process
2288	winmgr.exe
2668	winmgr.exe

pid	process
2164	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
2164	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
2288	winmgr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe"	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe"	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe

Drops file in System32 directory 4 IoCs

Processes:

winmgr.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe	winmgr.exe
File created	C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe	winmgr.exe
File opened for modification	C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE	winmgr.exe
File created	C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE	winmgr.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exewinmgr.exe

description	pid	process	target process
PID 2944 set thread context of 2164	2944	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
PID 2288 set thread context of 2668	2288	winmgr.exe	winmgr.exe

Drops file in Windows directory 3 IoCs

Processes:

2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe

description	ioc	process
File created	C:\Windows\M-50502979739026720652860250\winmgr.exe	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
File opened for modification	C:\Windows\M-50502979739026720652860250\winmgr.exe	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
File opened for modification	C:\Windows\M-50502979739026720652860250	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exewinmgr.exe

description	pid	process	target process
PID 2944 wrote to memory of 2164	2944	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
PID 2944 wrote to memory of 2164	2944	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
PID 2944 wrote to memory of 2164	2944	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
PID 2944 wrote to memory of 2164	2944	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
PID 2944 wrote to memory of 2164	2944	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
PID 2944 wrote to memory of 2164	2944	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
PID 2944 wrote to memory of 2164	2944	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
PID 2944 wrote to memory of 2164	2944	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
PID 2944 wrote to memory of 2164	2944	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
PID 2944 wrote to memory of 2164	2944	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
PID 2164 wrote to memory of 2076	2164	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	cmd.exe
PID 2164 wrote to memory of 2076	2164	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	cmd.exe
PID 2164 wrote to memory of 2076	2164	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	cmd.exe
PID 2164 wrote to memory of 2076	2164	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	cmd.exe
PID 2164 wrote to memory of 2288	2164	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	winmgr.exe
PID 2164 wrote to memory of 2288	2164	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	winmgr.exe
PID 2164 wrote to memory of 2288	2164	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	winmgr.exe
PID 2164 wrote to memory of 2288	2164	2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe	winmgr.exe
PID 2288 wrote to memory of 2668	2288	winmgr.exe	winmgr.exe
PID 2288 wrote to memory of 2668	2288	winmgr.exe	winmgr.exe
PID 2288 wrote to memory of 2668	2288	winmgr.exe	winmgr.exe
PID 2288 wrote to memory of 2668	2288	winmgr.exe	winmgr.exe
PID 2288 wrote to memory of 2668	2288	winmgr.exe	winmgr.exe
PID 2288 wrote to memory of 2668	2288	winmgr.exe	winmgr.exe
PID 2288 wrote to memory of 2668	2288	winmgr.exe	winmgr.exe
PID 2288 wrote to memory of 2668	2288	winmgr.exe	winmgr.exe
PID 2288 wrote to memory of 2668	2288	winmgr.exe	winmgr.exe
PID 2288 wrote to memory of 2668	2288	winmgr.exe	winmgr.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2944

C:\Users\Admin\AppData\Local\Temp\2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_2132e25ee51252d3647030b6f6b75d5e_magniber.exe"
2⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\htwqkxkmll.bat" "
3⤵
- Deletes itself
PID:2076

C:\Windows\M-50502979739026720652860250\winmgr.exe
C:\Windows\M-50502979739026720652860250\winmgr.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\M-50502979739026720652860250\winmgr.exe
C:\Windows\M-50502979739026720652860250\winmgr.exe
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2668

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\htwqkxkmll.bat
Filesize
278B

MD5
53fd45d8fc5fff117c8c76f11d7a8af9

SHA1
5ff75c27d4bbb2b22bf7f0f63cf8d0b87f6d979e

SHA256
99e662d57d76bfc6915ba023bc9473f3ae4af97f0a406bcba1f69d0cb8a831c6

SHA512
3aac756f4f5e67052c25d92be197bcc3bd2266fdf28e958ce080ee0ce8cde8f70ac0ce453e14373d2156085b190a21c13f3c45153d160ec1396afb08cdf4b294

Download Submit
\Windows\M-50502979739026720652860250\winmgr.exe
Filesize
163KB

MD5
2132e25ee51252d3647030b6f6b75d5e

SHA1
aa7f9955779d63b2feaaa737a596a21a8b4a63f3

SHA256
9d06d05f13a917cfc9d26f15aec8fc73482bdb77af762981ed8d38ae4456fa7a

SHA512
e148bbeb047cffd2df991256efa7728509bce09b4f6df2f78efdad4bb74d0282e1f3612f34fbce25bd080f0823d88e4890eb6a768d69bc171ca5ad5a0f5de84b

Download Submit
memory/2164-7-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2164-5-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2164-9-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2164-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2288-29-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2288-39-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2288-40-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/2668-53-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2668-43-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2668-48-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2668-50-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2668-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2668-62-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2668-75-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2944-6-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2944-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2944-8-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads