9ebe16d9198024cbf01032bff134525253f43dd977d3d0545ad03126492a1cbc

General

Target

2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
Size

163KB
MD5

3c249222ff98e849169ea5408ba71e19
SHA1

cf48bf71102a3d7d8c770bdf0b342a0d03e9702a
SHA256

9ebe16d9198024cbf01032bff134525253f43dd977d3d0545ad03126492a1cbc
SHA512

6f8bbfca64961c5e4b436390e0eb0fecb54acbf5169053ae5fdce89518b3b58bafa8445d9ab73785b740349795f2e7d2064d9529d8dfa14163dcb666e0905ea6
SSDEEP

3072:3r1cWI8i05JurTwXU/ulPgc9qz+9+++++q+zH:b1RJxur8XMQPgyh+++++q+zH

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe

Executes dropped EXE 2 IoCs

Processes:

winmgr.exewinmgr.exe

pid process

1356 winmgr.exe
4436 winmgr.exe

pid	process
1356	winmgr.exe
4436	winmgr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe"	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe"	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exewinmgr.exe

description	pid	process	target process
PID 2412 set thread context of 3552	2412	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
PID 1356 set thread context of 4436	1356	winmgr.exe	winmgr.exe

Drops file in Program Files directory 8 IoCs

Processes:

winmgr.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll	winmgr.exe

Drops file in Windows directory 3 IoCs

Processes:

2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe

description	ioc	process
File created	C:\Windows\M-50502979739026720652860250\winmgr.exe	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
File opened for modification	C:\Windows\M-50502979739026720652860250\winmgr.exe	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
File opened for modification	C:\Windows\M-50502979739026720652860250	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exewinmgr.exe

description	pid	process	target process
PID 2412 wrote to memory of 3552	2412	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
PID 2412 wrote to memory of 3552	2412	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
PID 2412 wrote to memory of 3552	2412	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
PID 2412 wrote to memory of 3552	2412	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
PID 2412 wrote to memory of 3552	2412	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
PID 2412 wrote to memory of 3552	2412	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
PID 2412 wrote to memory of 3552	2412	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
PID 2412 wrote to memory of 3552	2412	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
PID 2412 wrote to memory of 3552	2412	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
PID 3552 wrote to memory of 1172	3552	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	cmd.exe
PID 3552 wrote to memory of 1172	3552	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	cmd.exe
PID 3552 wrote to memory of 1172	3552	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	cmd.exe
PID 3552 wrote to memory of 1356	3552	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	winmgr.exe
PID 3552 wrote to memory of 1356	3552	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	winmgr.exe
PID 3552 wrote to memory of 1356	3552	2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe	winmgr.exe
PID 1356 wrote to memory of 4436	1356	winmgr.exe	winmgr.exe
PID 1356 wrote to memory of 4436	1356	winmgr.exe	winmgr.exe
PID 1356 wrote to memory of 4436	1356	winmgr.exe	winmgr.exe
PID 1356 wrote to memory of 4436	1356	winmgr.exe	winmgr.exe
PID 1356 wrote to memory of 4436	1356	winmgr.exe	winmgr.exe
PID 1356 wrote to memory of 4436	1356	winmgr.exe	winmgr.exe
PID 1356 wrote to memory of 4436	1356	winmgr.exe	winmgr.exe
PID 1356 wrote to memory of 4436	1356	winmgr.exe	winmgr.exe
PID 1356 wrote to memory of 4436	1356	winmgr.exe	winmgr.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2412

C:\Users\Admin\AppData\Local\Temp\2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_3c249222ff98e849169ea5408ba71e19_magniber.exe"
2⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jfzmahhjbv.bat" "
3⤵
PID:1172

C:\Windows\M-50502979739026720652860250\winmgr.exe
C:\Windows\M-50502979739026720652860250\winmgr.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\M-50502979739026720652860250\winmgr.exe
C:\Windows\M-50502979739026720652860250\winmgr.exe
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4436

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jfzmahhjbv.bat
Filesize
278B

MD5
4041b08356a83b7b94287d087987a625

SHA1
b1651d60156ce7c2e8fa390dbb6cb3a4a12ec9af

SHA256
cdcee29d852d94ace1ea096e50595e531e26d8b10a7d9f17bf1cabdef73c33ba

SHA512
ea288581e0b995bf28dfdc440d6154f7398398362e3f2d1969fda81b8365ed5d7423805879b04cbc1609604c71239073cd87fed026928b7e53023ad9a0a9ce13

Download Submit
C:\Users\Admin\AppData\Local\Temp\phqghumeay
Filesize
165KB

MD5
500237da069f05dcedb7fa187c613d98

SHA1
196abe18b19a4b2e0c9728c4e535f94a99c1de81

SHA256
ef162e0b023ea1d5131d11d5a33064e3fd0b1ae9698dc23d53bd9210afdda240

SHA512
5350a4f2900c18d66a8a3c94d0dd7c705671eb78c62f64a68b23fb0b7dab2c8d03f43be2bdaa5074ecee64dc3535579897004f52b3b3960911d8a9872b217aa0

Download Submit
C:\Windows\M-50502979739026720652860250\winmgr.exe
Filesize
163KB

MD5
3c249222ff98e849169ea5408ba71e19

SHA1
cf48bf71102a3d7d8c770bdf0b342a0d03e9702a

SHA256
9ebe16d9198024cbf01032bff134525253f43dd977d3d0545ad03126492a1cbc

SHA512
6f8bbfca64961c5e4b436390e0eb0fecb54acbf5169053ae5fdce89518b3b58bafa8445d9ab73785b740349795f2e7d2064d9529d8dfa14163dcb666e0905ea6

Download Submit
memory/1356-23-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1356-26-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1356-18-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2412-4-0x00000000007F0000-0x00000000008F0000-memory.dmp

Filesize
1024KB

Download
memory/2412-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2412-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3552-7-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3552-6-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3552-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4436-28-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4436-38-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4436-39-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4436-45-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4436-46-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4436-55-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4436-62-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4436-63-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4436-65-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads