9236d6a1220e6865effbf65a081aa2e0a3bf1b70969bd52d835c6ab2de207fcc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-28_11f28eb54a1906f7f710067f0401c8f1_magniber
Size

205KB
Sample

240528-g93jfaaf29
MD5

11f28eb54a1906f7f710067f0401c8f1
SHA1

a7c053fb2575408b2771a93eb8746b8e749791cf
SHA256

9236d6a1220e6865effbf65a081aa2e0a3bf1b70969bd52d835c6ab2de207fcc
SHA512

22f8c6511861acc0552b012562bcdd9ea759261c2c0863989e05f26b90f5c75e2345dba35f55a11bd13fff0d4a5816d1512fa675cae24605655963eefb1f7b22
SSDEEP

3072:JqEo7L4ueEp6Bxf3IbgFPJipLgaJ5R56AtCw9THbmQ6h6pxMJJgZOiUZBqZS9Y:IEaLjp6Bybjb5+AhHbmpJJy5

Score

10^/10

evasion persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-05-28_11f28eb54a1906f7f710067f0401c8f1_magniber
- Size
  
  205KB
- MD5
  
  11f28eb54a1906f7f710067f0401c8f1
- SHA1
  
  a7c053fb2575408b2771a93eb8746b8e749791cf
- SHA256
  
  9236d6a1220e6865effbf65a081aa2e0a3bf1b70969bd52d835c6ab2de207fcc
- SHA512
  
  22f8c6511861acc0552b012562bcdd9ea759261c2c0863989e05f26b90f5c75e2345dba35f55a11bd13fff0d4a5816d1512fa675cae24605655963eefb1f7b22
- SSDEEP
  
  3072:JqEo7L4ueEp6Bxf3IbgFPJipLgaJ5R56AtCw9THbmQ6h6pxMJJgZOiUZBqZS9Y:IEaLjp6Bybjb5+AhHbmpJJy5
Score

10^/10

evasion persistence spyware stealer
- Modifies security service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencespywarestealer

behavioral2