2c69fc103729b82505265f1dcc44787af5f11f144fa3be6763a44c204b9ffadf

General

Target

2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe
Size

332KB
MD5

39ccaf94b21625bceeac15b67bdbe0c3
SHA1

a0cc7ad11c7c62be886e3a65b701b86d936e57d7
SHA256

2c69fc103729b82505265f1dcc44787af5f11f144fa3be6763a44c204b9ffadf
SHA512

8c396b49460e94f1c34bff456759fff45357d994f345c1c96449e468fb38e5d7ddb30c66470b76ae376b6cc13b6419604704b8a1d72d86339a72c653f62af08f
SSDEEP

6144:aEaLjp6Bybjb5+AhHbmpJJylyiCGWVdB8W:aZHcybn5V9mpJJq0G4Tt

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe

Executes dropped EXE 2 IoCs

pid	Process
4280	winmgr.exe
4976	winmgr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-5050572947025827857375865240\\winmgr.exe"	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-5050572947025827857375865240\\winmgr.exe"	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1792 set thread context of 4360	1792	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	90
PID 4280 set thread context of 4976	4280	winmgr.exe	96

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	winmgr.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll	winmgr.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	winmgr.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\M-5050572947025827857375865240\winmgr.exe	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe
File opened for modification	C:\Windows\M-5050572947025827857375865240\winmgr.exe	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe
File opened for modification	C:\Windows\M-5050572947025827857375865240	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 4360	1792	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	90
PID 1792 wrote to memory of 4360	1792	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	90
PID 1792 wrote to memory of 4360	1792	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	90
PID 1792 wrote to memory of 4360	1792	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	90
PID 1792 wrote to memory of 4360	1792	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	90
PID 1792 wrote to memory of 4360	1792	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	90
PID 1792 wrote to memory of 4360	1792	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	90
PID 1792 wrote to memory of 4360	1792	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	90
PID 1792 wrote to memory of 4360	1792	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	90
PID 4360 wrote to memory of 1948	4360	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	92
PID 4360 wrote to memory of 1948	4360	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	92
PID 4360 wrote to memory of 1948	4360	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	92
PID 4360 wrote to memory of 4280	4360	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	94
PID 4360 wrote to memory of 4280	4360	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	94
PID 4360 wrote to memory of 4280	4360	2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe	94
PID 4280 wrote to memory of 4976	4280	winmgr.exe	96
PID 4280 wrote to memory of 4976	4280	winmgr.exe	96
PID 4280 wrote to memory of 4976	4280	winmgr.exe	96
PID 4280 wrote to memory of 4976	4280	winmgr.exe	96
PID 4280 wrote to memory of 4976	4280	winmgr.exe	96
PID 4280 wrote to memory of 4976	4280	winmgr.exe	96
PID 4280 wrote to memory of 4976	4280	winmgr.exe	96
PID 4280 wrote to memory of 4976	4280	winmgr.exe	96
PID 4280 wrote to memory of 4976	4280	winmgr.exe	96

C:\Users\Admin\AppData\Local\Temp\2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-05-17_39ccaf94b21625bceeac15b67bdbe0c3_magniber.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qrkiadzolz.bat" "
    3⤵
    PID:1948
- - C:\Windows\M-5050572947025827857375865240\winmgr.exe
    C:\Windows\M-5050572947025827857375865240\winmgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Windows\M-5050572947025827857375865240\winmgr.exe
      C:\Windows\M-5050572947025827857375865240\winmgr.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\phqghumeay

Filesize
333KB

MD5
9e7dbafa14992021ec3fd221fb8b2aab

SHA1
6d8e562a1aee7b10706b77545cd0cbefd1a880f6

SHA256
b623275e97eed7e09a35840de6055515b81c20be91bfe1f26a9033fc51df3c7c

SHA512
963aa97f54d95e0663b56cc65699591e4814d384c879b661bd7c3db1177f8aabbc993d4a4db5b33fcea3b028e5afe3e3949b8f33d908d53c7966d1fba45fe379

Download Submit
C:\Users\Admin\AppData\Local\Temp\qrkiadzolz.bat

Filesize
278B

MD5
dfb86ee1f01db28085d7751ba735f5fd

SHA1
9ffa598500fd83ab7971caac7f41c5f7f9286eb0

SHA256
d28256105f08b866710a5e38402534dc761e3ed430cc0098c7b22d9a3b7d5959

SHA512
d03ccd2bf12c8591d20bfc8b1a5f63615165f8cd193c82fc50c9afbabf30daec390cc2d87ceb38cb97967468cf12df4bd22a7c8087d137b9bc6c75dd9136676f

Download Submit
C:\Windows\M-5050572947025827857375865240\winmgr.exe

Filesize
332KB

MD5
39ccaf94b21625bceeac15b67bdbe0c3

SHA1
a0cc7ad11c7c62be886e3a65b701b86d936e57d7

SHA256
2c69fc103729b82505265f1dcc44787af5f11f144fa3be6763a44c204b9ffadf

SHA512
8c396b49460e94f1c34bff456759fff45357d994f345c1c96449e468fb38e5d7ddb30c66470b76ae376b6cc13b6419604704b8a1d72d86339a72c653f62af08f

Download Submit
memory/1792-3-0x0000000000600000-0x0000000000700000-memory.dmp

Filesize
1024KB

Download
memory/1792-5-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1792-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4280-20-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4280-25-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4360-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4360-7-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4360-6-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4976-27-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4976-37-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4976-38-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4976-44-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4976-45-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4976-54-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4976-61-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4976-62-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4976-64-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads