2c69fc103729b82505265f1dcc44787af5f11f144fa3be6763a44c204b9ffadf

Analysis

max time kernel
147s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe
Size

332KB
MD5

39ccaf94b21625bceeac15b67bdbe0c3
SHA1

a0cc7ad11c7c62be886e3a65b701b86d936e57d7
SHA256

2c69fc103729b82505265f1dcc44787af5f11f144fa3be6763a44c204b9ffadf
SHA512

8c396b49460e94f1c34bff456759fff45357d994f345c1c96449e468fb38e5d7ddb30c66470b76ae376b6cc13b6419604704b8a1d72d86339a72c653f62af08f
SSDEEP

6144:aEaLjp6Bybjb5+AhHbmpJJylyiCGWVdB8W:aZHcybn5V9mpJJq0G4Tt

Score

10^/10

evasion persistence spyware stealer

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe

Deletes itself 1 IoCs

pid	Process
2264	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2612	winmgr.exe
2536	winmgr.exe

Loads dropped DLL 3 IoCs

pid	Process
832	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe
832	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe
2612	winmgr.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-5050572947025827857375865240\\winmgr.exe"	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-5050572947025827857375865240\\winmgr.exe"	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe	winmgr.exe
File created	C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe	winmgr.exe
File opened for modification	C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE	winmgr.exe
File created	C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE	winmgr.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2696 set thread context of 832	2696	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	28
PID 2612 set thread context of 2536	2612	winmgr.exe	32

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\M-5050572947025827857375865240\winmgr.exe	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe
File opened for modification	C:\Windows\M-5050572947025827857375865240\winmgr.exe	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe
File opened for modification	C:\Windows\M-5050572947025827857375865240	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 832	2696	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	28
PID 2696 wrote to memory of 832	2696	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	28
PID 2696 wrote to memory of 832	2696	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	28
PID 2696 wrote to memory of 832	2696	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	28
PID 2696 wrote to memory of 832	2696	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	28
PID 2696 wrote to memory of 832	2696	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	28
PID 2696 wrote to memory of 832	2696	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	28
PID 2696 wrote to memory of 832	2696	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	28
PID 2696 wrote to memory of 832	2696	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	28
PID 2696 wrote to memory of 832	2696	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	28
PID 832 wrote to memory of 2264	832	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	29
PID 832 wrote to memory of 2264	832	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	29
PID 832 wrote to memory of 2264	832	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	29
PID 832 wrote to memory of 2264	832	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	29
PID 832 wrote to memory of 2612	832	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	31
PID 832 wrote to memory of 2612	832	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	31
PID 832 wrote to memory of 2612	832	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	31
PID 832 wrote to memory of 2612	832	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	31
PID 2612 wrote to memory of 2536	2612	winmgr.exe	32
PID 2612 wrote to memory of 2536	2612	winmgr.exe	32
PID 2612 wrote to memory of 2536	2612	winmgr.exe	32
PID 2612 wrote to memory of 2536	2612	winmgr.exe	32
PID 2612 wrote to memory of 2536	2612	winmgr.exe	32
PID 2612 wrote to memory of 2536	2612	winmgr.exe	32
PID 2612 wrote to memory of 2536	2612	winmgr.exe	32
PID 2612 wrote to memory of 2536	2612	winmgr.exe	32
PID 2612 wrote to memory of 2536	2612	winmgr.exe	32
PID 2612 wrote to memory of 2536	2612	winmgr.exe	32

C:\Users\Admin\AppData\Local\Temp\2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe"
  2⤵
  - Modifies security service
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\yzfogqfwas.bat" "
    3⤵
    - Deletes itself
    PID:2264
- - C:\Windows\M-5050572947025827857375865240\winmgr.exe
    C:\Windows\M-5050572947025827857375865240\winmgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\M-5050572947025827857375865240\winmgr.exe
      C:\Windows\M-5050572947025827857375865240\winmgr.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yzfogqfwas.bat

Filesize
278B

MD5
3d7f6f289443019fa8207ea3c7fedc23

SHA1
57d592b577c439df20b82a1889599851d0913407

SHA256
8d56f6f422670e41edee71a6f71168930bbf06fc3ef2eb2f7d9f237311302bb5

SHA512
68484a51153baa42269c738e7788395ce14af69eef4ae156ead464248832c31e7ccc4e73c520e044e7ed301ce5c2e253f626595796066f1ff33c36b646096656

Download Submit
C:\Windows\M-5050572947025827857375865240\winmgr.exe

Filesize
332KB

MD5
39ccaf94b21625bceeac15b67bdbe0c3

SHA1
a0cc7ad11c7c62be886e3a65b701b86d936e57d7

SHA256
2c69fc103729b82505265f1dcc44787af5f11f144fa3be6763a44c204b9ffadf

SHA512
8c396b49460e94f1c34bff456759fff45357d994f345c1c96449e468fb38e5d7ddb30c66470b76ae376b6cc13b6419604704b8a1d72d86339a72c653f62af08f

Download Submit
memory/832-4-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/832-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/832-9-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/832-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2536-43-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2536-48-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2536-50-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2536-53-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2536-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2536-62-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2536-75-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2612-29-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2612-34-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2612-39-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2696-6-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2696-7-0x0000000000537000-0x0000000000543000-memory.dmp

Filesize
48KB

Download
memory/2696-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads