Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 14:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe
-
Size
163KB
-
MD5
43a56c07892047cc90e664af4ace0f3b
-
SHA1
b67718b23c92ec69e805741a783bc34ba4da2ad4
-
SHA256
12d3c28faba2830eacc5a23b227c0bc7a51e9c23b406f6f13850874aec45700e
-
SHA512
bb3cddfe098929f99904628ef073320393b7282a9a4c2717609a8043d982818139848aa56f96811d90fad013ab78dd76325e3a1a38bf007cc1896aba6126b9d0
-
SSDEEP
3072:3r1cWI8i05JurTwXU/ulPgc9qz+9+++++++qq+7:b1RJxur8XMQPgyh+++++++qq+7
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe -
Executes dropped EXE 2 IoCs
Processes:
winmgr.exewinmgr.exepid process 2724 winmgr.exe 4600 winmgr.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe" 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe" 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exewinmgr.exedescription pid process target process PID 3608 set thread context of 4480 3608 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 2724 set thread context of 4600 2724 winmgr.exe winmgr.exe -
Drops file in Program Files directory 8 IoCs
Processes:
winmgr.exedescription ioc process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe winmgr.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll winmgr.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll winmgr.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe winmgr.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe winmgr.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll winmgr.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll winmgr.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe winmgr.exe -
Drops file in Windows directory 3 IoCs
Processes:
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exedescription ioc process File created C:\Windows\M-50502979739026720652860250\winmgr.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe File opened for modification C:\Windows\M-50502979739026720652860250\winmgr.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe File opened for modification C:\Windows\M-50502979739026720652860250 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exewinmgr.exedescription pid process target process PID 3608 wrote to memory of 4480 3608 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 3608 wrote to memory of 4480 3608 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 3608 wrote to memory of 4480 3608 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 3608 wrote to memory of 4480 3608 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 3608 wrote to memory of 4480 3608 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 3608 wrote to memory of 4480 3608 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 3608 wrote to memory of 4480 3608 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 3608 wrote to memory of 4480 3608 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 3608 wrote to memory of 4480 3608 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe PID 4480 wrote to memory of 776 4480 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe cmd.exe PID 4480 wrote to memory of 776 4480 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe cmd.exe PID 4480 wrote to memory of 776 4480 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe cmd.exe PID 4480 wrote to memory of 2724 4480 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe winmgr.exe PID 4480 wrote to memory of 2724 4480 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe winmgr.exe PID 4480 wrote to memory of 2724 4480 2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe winmgr.exe PID 2724 wrote to memory of 4600 2724 winmgr.exe winmgr.exe PID 2724 wrote to memory of 4600 2724 winmgr.exe winmgr.exe PID 2724 wrote to memory of 4600 2724 winmgr.exe winmgr.exe PID 2724 wrote to memory of 4600 2724 winmgr.exe winmgr.exe PID 2724 wrote to memory of 4600 2724 winmgr.exe winmgr.exe PID 2724 wrote to memory of 4600 2724 winmgr.exe winmgr.exe PID 2724 wrote to memory of 4600 2724 winmgr.exe winmgr.exe PID 2724 wrote to memory of 4600 2724 winmgr.exe winmgr.exe PID 2724 wrote to memory of 4600 2724 winmgr.exe winmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_43a56c07892047cc90e664af4ace0f3b_magniber.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wepyegxnlo.bat" "3⤵PID:776
-
C:\Windows\M-50502979739026720652860250\winmgr.exeC:\Windows\M-50502979739026720652860250\winmgr.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\M-50502979739026720652860250\winmgr.exeC:\Windows\M-50502979739026720652860250\winmgr.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\phqghumeayFilesize
164KB
MD525229c05ade418de076c4210baed43d2
SHA1d1c2ad3e9a4b4a8664c378d915da286f298e0918
SHA2563e9c1e3acfd93ca3211cd046157dcf1f0457a7b47db8f4f2a3f2ab1d5a8deb4a
SHA512c731579033f4a2947e493f2acf7ca79ad3f5ffab0e72c92d3a9f6e15cf69d25c436073c68cdcc428b8770a67b42d2393a2ebe71142c595fea4bd540eea1209fc
-
C:\Users\Admin\AppData\Local\Temp\wepyegxnlo.batFilesize
278B
MD57376577951d2bcf3c19aace64ac7decb
SHA19d3ba84981b317979be745629a3c8e9a4af0dbaa
SHA256acd01a90b91069ba22ac2606b60bdfd8b75b38491f48d6db9de1aca14f1a19e7
SHA5126713182bda733308fc55cbd9d34e2d5a215f90db33e0f1ea7172a3f77a948f3eeff27d8777b24bd2ab760d60d2d0c166fd00d2bab5e67610da4466344083ed43
-
C:\Windows\M-50502979739026720652860250\winmgr.exeFilesize
163KB
MD543a56c07892047cc90e664af4ace0f3b
SHA1b67718b23c92ec69e805741a783bc34ba4da2ad4
SHA25612d3c28faba2830eacc5a23b227c0bc7a51e9c23b406f6f13850874aec45700e
SHA512bb3cddfe098929f99904628ef073320393b7282a9a4c2717609a8043d982818139848aa56f96811d90fad013ab78dd76325e3a1a38bf007cc1896aba6126b9d0
-
memory/2724-26-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2724-21-0x0000000000680000-0x0000000000780000-memory.dmpFilesize
1024KB
-
memory/2724-18-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3608-6-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3608-0-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3608-4-0x0000000000690000-0x0000000000790000-memory.dmpFilesize
1024KB
-
memory/4480-7-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4480-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4480-5-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4600-25-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4600-27-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4600-29-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4600-39-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4600-46-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4600-56-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4600-63-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB