bf06e12df3325158df770827a5573db9b2984551cd6a8cd95d3201660ddaebca

General

Target

2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
Size

164KB
MD5

efd5eabc8757cdd3e09fb06fde1a6083
SHA1

4219d1517d953b4d102b3d38c091be6aa73f9e05
SHA256

bf06e12df3325158df770827a5573db9b2984551cd6a8cd95d3201660ddaebca
SHA512

c3123a2660178d4296d61bec3245211bbf7e33529b32b89d72cc39d6f8372d03da0b47fb60a88fde8a75a8e5fee391f8a35b7c4acffb604c7e3ccbd57db47376
SSDEEP

3072:3r1cWI8i05JurTwXU/ulPgc9qz+9+++++q+l++7:b1RJxur8XMQPgyh+++++q+l++7

Score

10^/10

evasion persistence spyware stealer

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2744 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

winmgr.exewinmgr.exe

pid process

2700 winmgr.exe
2564 winmgr.exe
Loads dropped DLL 3 IoCs

Processes:

2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exewinmgr.exe

pid process

2772 2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
2772 2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
2700 winmgr.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2744	cmd.exe

pid	process
2700	winmgr.exe
2564	winmgr.exe

pid	process
2772	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
2772	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
2700	winmgr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe"	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50502979739026720652860250\\winmgr.exe"	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe

Drops file in System32 directory 4 IoCs

Processes:

winmgr.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe	winmgr.exe
File created	C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe	winmgr.exe
File opened for modification	C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE	winmgr.exe
File created	C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE	winmgr.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exewinmgr.exe

description	pid	process	target process
PID 1996 set thread context of 2772	1996	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
PID 2700 set thread context of 2564	2700	winmgr.exe	winmgr.exe

Drops file in Windows directory 3 IoCs

Processes:

2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe

description	ioc	process
File created	C:\Windows\M-50502979739026720652860250\winmgr.exe	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
File opened for modification	C:\Windows\M-50502979739026720652860250\winmgr.exe	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
File opened for modification	C:\Windows\M-50502979739026720652860250	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exewinmgr.exe

description	pid	process	target process
PID 1996 wrote to memory of 2772	1996	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
PID 1996 wrote to memory of 2772	1996	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
PID 1996 wrote to memory of 2772	1996	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
PID 1996 wrote to memory of 2772	1996	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
PID 1996 wrote to memory of 2772	1996	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
PID 1996 wrote to memory of 2772	1996	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
PID 1996 wrote to memory of 2772	1996	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
PID 1996 wrote to memory of 2772	1996	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
PID 1996 wrote to memory of 2772	1996	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
PID 1996 wrote to memory of 2772	1996	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
PID 2772 wrote to memory of 2744	2772	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	cmd.exe
PID 2772 wrote to memory of 2744	2772	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	cmd.exe
PID 2772 wrote to memory of 2744	2772	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	cmd.exe
PID 2772 wrote to memory of 2744	2772	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	cmd.exe
PID 2772 wrote to memory of 2700	2772	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	winmgr.exe
PID 2772 wrote to memory of 2700	2772	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	winmgr.exe
PID 2772 wrote to memory of 2700	2772	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	winmgr.exe
PID 2772 wrote to memory of 2700	2772	2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe	winmgr.exe
PID 2700 wrote to memory of 2564	2700	winmgr.exe	winmgr.exe
PID 2700 wrote to memory of 2564	2700	winmgr.exe	winmgr.exe
PID 2700 wrote to memory of 2564	2700	winmgr.exe	winmgr.exe
PID 2700 wrote to memory of 2564	2700	winmgr.exe	winmgr.exe
PID 2700 wrote to memory of 2564	2700	winmgr.exe	winmgr.exe
PID 2700 wrote to memory of 2564	2700	winmgr.exe	winmgr.exe
PID 2700 wrote to memory of 2564	2700	winmgr.exe	winmgr.exe
PID 2700 wrote to memory of 2564	2700	winmgr.exe	winmgr.exe
PID 2700 wrote to memory of 2564	2700	winmgr.exe	winmgr.exe
PID 2700 wrote to memory of 2564	2700	winmgr.exe	winmgr.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Local\Temp\2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_efd5eabc8757cdd3e09fb06fde1a6083_magniber.exe"
2⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\lruhtzjjyu.bat" "
3⤵
- Deletes itself
PID:2744

C:\Windows\M-50502979739026720652860250\winmgr.exe
C:\Windows\M-50502979739026720652860250\winmgr.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\M-50502979739026720652860250\winmgr.exe
C:\Windows\M-50502979739026720652860250\winmgr.exe
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2564

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lruhtzjjyu.bat
Filesize
278B

MD5
d0dbf7ef5d4d7676a419f8e1d79a6a83

SHA1
9cacdb2d2d2f921e255f7aba0275a05325e17879

SHA256
03df9fe06fe7c61278d51a98fcb376ebc6548333f6ac627fd66bf63303889980

SHA512
541cd2f557fe126f0ccff9208431f15cfc3ec9f8f28f5d7ab2b52e2b962d5c5e075c004e23b388b62e3290de1dcf4b7bdb6b8146f510a059fec7cd15d97a4669

Download Submit
\Windows\M-50502979739026720652860250\winmgr.exe
Filesize
164KB

MD5
efd5eabc8757cdd3e09fb06fde1a6083

SHA1
4219d1517d953b4d102b3d38c091be6aa73f9e05

SHA256
bf06e12df3325158df770827a5573db9b2984551cd6a8cd95d3201660ddaebca

SHA512
c3123a2660178d4296d61bec3245211bbf7e33529b32b89d72cc39d6f8372d03da0b47fb60a88fde8a75a8e5fee391f8a35b7c4acffb604c7e3ccbd57db47376

Download Submit
memory/1996-7-0x00000000008B5000-0x00000000008C0000-memory.dmp

Filesize
44KB

Download
memory/1996-6-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1996-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2564-44-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2564-76-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2564-59-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2564-57-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2564-54-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2564-51-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2564-49-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2700-30-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2700-35-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/2700-40-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2772-22-0x0000000002A50000-0x0000000002A7C000-memory.dmp

Filesize
176KB

Download
memory/2772-9-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2772-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2772-4-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2772-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads