12d3c28faba2830eacc5a23b227c0bc7a51e9c23b406f6f13850874aec45700e

General

Target

2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
Size

163KB
MD5

43a56c07892047cc90e664af4ace0f3b
SHA1

b67718b23c92ec69e805741a783bc34ba4da2ad4
SHA256

12d3c28faba2830eacc5a23b227c0bc7a51e9c23b406f6f13850874aec45700e
SHA512

bb3cddfe098929f99904628ef073320393b7282a9a4c2717609a8043d982818139848aa56f96811d90fad013ab78dd76325e3a1a38bf007cc1896aba6126b9d0
SSDEEP

3072:3r1cWI8i05JurTwXU/ulPgc9qz+9+++++++qq+7:b1RJxur8XMQPgyh+++++++qq+7

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe

Executes dropped EXE 2 IoCs

Processes:

winmgr.exewinmgr.exe

pid process

2724 winmgr.exe
4600 winmgr.exe

pid	process
2724	winmgr.exe
4600	winmgr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe"	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe"	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exewinmgr.exe

description	pid	process	target process
PID 3608 set thread context of 4480	3608	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
PID 2724 set thread context of 4600	2724	winmgr.exe	winmgr.exe

Drops file in Program Files directory 8 IoCs

Processes:

winmgr.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	winmgr.exe

Drops file in Windows directory 3 IoCs

Processes:

2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe

description	ioc	process
File created	C:\Windows\M-50502979739026720652860250\winmgr.exe	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
File opened for modification	C:\Windows\M-50502979739026720652860250\winmgr.exe	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
File opened for modification	C:\Windows\M-50502979739026720652860250	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exewinmgr.exe

description	pid	process	target process
PID 3608 wrote to memory of 4480	3608	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
PID 3608 wrote to memory of 4480	3608	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
PID 3608 wrote to memory of 4480	3608	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
PID 3608 wrote to memory of 4480	3608	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
PID 3608 wrote to memory of 4480	3608	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
PID 3608 wrote to memory of 4480	3608	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
PID 3608 wrote to memory of 4480	3608	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
PID 3608 wrote to memory of 4480	3608	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
PID 3608 wrote to memory of 4480	3608	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
PID 4480 wrote to memory of 776	4480	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	cmd.exe
PID 4480 wrote to memory of 776	4480	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	cmd.exe
PID 4480 wrote to memory of 776	4480	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	cmd.exe
PID 4480 wrote to memory of 2724	4480	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	winmgr.exe
PID 4480 wrote to memory of 2724	4480	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	winmgr.exe
PID 4480 wrote to memory of 2724	4480	2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe	winmgr.exe
PID 2724 wrote to memory of 4600	2724	winmgr.exe	winmgr.exe
PID 2724 wrote to memory of 4600	2724	winmgr.exe	winmgr.exe
PID 2724 wrote to memory of 4600	2724	winmgr.exe	winmgr.exe
PID 2724 wrote to memory of 4600	2724	winmgr.exe	winmgr.exe
PID 2724 wrote to memory of 4600	2724	winmgr.exe	winmgr.exe
PID 2724 wrote to memory of 4600	2724	winmgr.exe	winmgr.exe
PID 2724 wrote to memory of 4600	2724	winmgr.exe	winmgr.exe
PID 2724 wrote to memory of 4600	2724	winmgr.exe	winmgr.exe
PID 2724 wrote to memory of 4600	2724	winmgr.exe	winmgr.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3608

C:\Users\Admin\AppData\Local\Temp\2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe"
2⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wepyegxnlo.bat" "
3⤵
PID:776

C:\Windows\M-50502979739026720652860250\winmgr.exe
C:\Windows\M-50502979739026720652860250\winmgr.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\M-50502979739026720652860250\winmgr.exe
C:\Windows\M-50502979739026720652860250\winmgr.exe
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4600

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\phqghumeay
Filesize
164KB

MD5
25229c05ade418de076c4210baed43d2

SHA1
d1c2ad3e9a4b4a8664c378d915da286f298e0918

SHA256
3e9c1e3acfd93ca3211cd046157dcf1f0457a7b47db8f4f2a3f2ab1d5a8deb4a

SHA512
c731579033f4a2947e493f2acf7ca79ad3f5ffab0e72c92d3a9f6e15cf69d25c436073c68cdcc428b8770a67b42d2393a2ebe71142c595fea4bd540eea1209fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\wepyegxnlo.bat
Filesize
278B

MD5
7376577951d2bcf3c19aace64ac7decb

SHA1
9d3ba84981b317979be745629a3c8e9a4af0dbaa

SHA256
acd01a90b91069ba22ac2606b60bdfd8b75b38491f48d6db9de1aca14f1a19e7

SHA512
6713182bda733308fc55cbd9d34e2d5a215f90db33e0f1ea7172a3f77a948f3eeff27d8777b24bd2ab760d60d2d0c166fd00d2bab5e67610da4466344083ed43

Download Submit
C:\Windows\M-50502979739026720652860250\winmgr.exe
Filesize
163KB

MD5
43a56c07892047cc90e664af4ace0f3b

SHA1
b67718b23c92ec69e805741a783bc34ba4da2ad4

SHA256
12d3c28faba2830eacc5a23b227c0bc7a51e9c23b406f6f13850874aec45700e

SHA512
bb3cddfe098929f99904628ef073320393b7282a9a4c2717609a8043d982818139848aa56f96811d90fad013ab78dd76325e3a1a38bf007cc1896aba6126b9d0

Download Submit
memory/2724-26-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2724-21-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/2724-18-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3608-6-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3608-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3608-4-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/4480-7-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4480-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4480-5-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4600-25-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4600-27-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4600-29-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4600-39-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4600-46-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4600-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4600-63-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads