Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 14:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
-
Size
163KB
-
MD5
43a56c07892047cc90e664af4ace0f3b
-
SHA1
b67718b23c92ec69e805741a783bc34ba4da2ad4
-
SHA256
12d3c28faba2830eacc5a23b227c0bc7a51e9c23b406f6f13850874aec45700e
-
SHA512
bb3cddfe098929f99904628ef073320393b7282a9a4c2717609a8043d982818139848aa56f96811d90fad013ab78dd76325e3a1a38bf007cc1896aba6126b9d0
-
SSDEEP
3072:3r1cWI8i05JurTwXU/ulPgc9qz+9+++++++qq+7:b1RJxur8XMQPgyh+++++++qq+7
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2692 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
winmgr.exewinmgr.exepid process 2660 winmgr.exe 2728 winmgr.exe -
Loads dropped DLL 3 IoCs
Processes:
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exewinmgr.exepid process 2936 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2936 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2660 winmgr.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe" 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe" 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe -
Drops file in System32 directory 4 IoCs
Processes:
winmgr.exedescription ioc process File opened for modification C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe winmgr.exe File created C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe winmgr.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE winmgr.exe File created C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE winmgr.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exewinmgr.exedescription pid process target process PID 1760 set thread context of 2936 1760 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 2660 set thread context of 2728 2660 winmgr.exe winmgr.exe -
Drops file in Windows directory 3 IoCs
Processes:
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exedescription ioc process File created C:\Windows\M-50502979739026720652860250\winmgr.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe File opened for modification C:\Windows\M-50502979739026720652860250\winmgr.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe File opened for modification C:\Windows\M-50502979739026720652860250 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exewinmgr.exedescription pid process target process PID 1760 wrote to memory of 2936 1760 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 1760 wrote to memory of 2936 1760 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 1760 wrote to memory of 2936 1760 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 1760 wrote to memory of 2936 1760 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 1760 wrote to memory of 2936 1760 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 1760 wrote to memory of 2936 1760 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 1760 wrote to memory of 2936 1760 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 1760 wrote to memory of 2936 1760 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 1760 wrote to memory of 2936 1760 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 1760 wrote to memory of 2936 1760 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 2936 wrote to memory of 2692 2936 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe cmd.exe PID 2936 wrote to memory of 2692 2936 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe cmd.exe PID 2936 wrote to memory of 2692 2936 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe cmd.exe PID 2936 wrote to memory of 2692 2936 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe cmd.exe PID 2936 wrote to memory of 2660 2936 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe winmgr.exe PID 2936 wrote to memory of 2660 2936 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe winmgr.exe PID 2936 wrote to memory of 2660 2936 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe winmgr.exe PID 2936 wrote to memory of 2660 2936 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe winmgr.exe PID 2660 wrote to memory of 2728 2660 winmgr.exe winmgr.exe PID 2660 wrote to memory of 2728 2660 winmgr.exe winmgr.exe PID 2660 wrote to memory of 2728 2660 winmgr.exe winmgr.exe PID 2660 wrote to memory of 2728 2660 winmgr.exe winmgr.exe PID 2660 wrote to memory of 2728 2660 winmgr.exe winmgr.exe PID 2660 wrote to memory of 2728 2660 winmgr.exe winmgr.exe PID 2660 wrote to memory of 2728 2660 winmgr.exe winmgr.exe PID 2660 wrote to memory of 2728 2660 winmgr.exe winmgr.exe PID 2660 wrote to memory of 2728 2660 winmgr.exe winmgr.exe PID 2660 wrote to memory of 2728 2660 winmgr.exe winmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe"2⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\xzfwtgcsoo.bat" "3⤵
- Deletes itself
PID:2692 -
C:\Windows\M-50502979739026720652860250\winmgr.exeC:\Windows\M-50502979739026720652860250\winmgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\M-50502979739026720652860250\winmgr.exeC:\Windows\M-50502979739026720652860250\winmgr.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2728
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\xzfwtgcsoo.batFilesize
278B
MD5676323a9157c329f95b60720587197c7
SHA1d9135420dbe393ae0d8e806c35ae6e29f0e835aa
SHA256eebcf0acf332fa6bf3f40cc0290ff239e97847f4fe4e259a2781a8871122dd7f
SHA512e750b76804e3741731aa0a8ef7af6875cf367cc0eea46983db9768a47cffbca4d9b8922ebef8816273d35ee1a140de522f2c5006c34cb14dafc7db0cfb286a21
-
C:\Windows\M-50502979739026720652860250\winmgr.exeFilesize
163KB
MD543a56c07892047cc90e664af4ace0f3b
SHA1b67718b23c92ec69e805741a783bc34ba4da2ad4
SHA25612d3c28faba2830eacc5a23b227c0bc7a51e9c23b406f6f13850874aec45700e
SHA512bb3cddfe098929f99904628ef073320393b7282a9a4c2717609a8043d982818139848aa56f96811d90fad013ab78dd76325e3a1a38bf007cc1896aba6126b9d0
-
memory/1760-8-0x0000000000270000-0x0000000000370000-memory.dmpFilesize
1024KB
-
memory/1760-0-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1760-6-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2660-38-0x00000000004D0000-0x00000000005D0000-memory.dmpFilesize
1024KB
-
memory/2660-29-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2660-41-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2660-40-0x00000000002D0000-0x00000000002FC000-memory.dmpFilesize
176KB
-
memory/2728-44-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2728-63-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2728-76-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2936-9-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2936-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2936-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2936-7-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB