Overview

overview

7

Static

static

3

2024-05-29...er.exe

windows7-x64

7

2024-05-29...er.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 19:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-29_aa0cea116fc4ca4a31d712d16c6c99ca_magniber.exe

  • Size

    43.5MB

  • MD5

    aa0cea116fc4ca4a31d712d16c6c99ca

  • SHA1

    efe7d7eb8f390164eed469187f18f733d7739eb5

  • SHA256

    a301e932f252b6b693a7b686e67f06bed72f5dd47b2316627fbc1e59785a03ac

  • SHA512

    7c751bcaa541f8152446f2741fe27ef73f2cb178342e4ad48615f68f7c26bdbdec6038956715ee8580096c280579c688e3b258f17b144d6036ec580bcd68ac91

  • SSDEEP

    786432:Nw8nIe84AaDI0h1kInVKyVTU+1vqdAlPbbxh/ldO9xShzjr/P6s1sl/wJc+P4:Nw8n7AL0hb4yVTU00Mj9yshz/11sl/wI

Score
7/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 2 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-29_aa0cea116fc4ca4a31d712d16c6c99ca_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-29_aa0cea116fc4ca4a31d712d16c6c99ca_magniber.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1012
      2⤵
      • Program crash
      PID:2736

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\lds_setup.log
          Filesize

          966B

          MD5

          9c31451e856fed03bd52ab7331869c34

          SHA1

          c391505eef8b25bd9512c71287358729d3baab37

          SHA256

          2f711127098187ae1419bb078f32decb293b097ebc6c0783db06618a6f8702f4

          SHA512

          8d88a4b3cc00b87038e9b9ea09c7f2f8a128ee74fa1738de4b74545df973deeb40824299cf6f89f9e371c3b613585bd0b93fdc12d67daad040c5e04b1b640c9f

          Download Submit

        • \Users\Admin\AppData\Local\Temp\{0D7B41A7-CD7A-43f4-9B18-8AAB57069326}.tmp\7z.dll
          Filesize

          1.1MB

          MD5

          2888126384d873cc49af32bbe34bb296

          SHA1

          fe74877bcaec93c7d67dab2ce8c86cfc38402d22

          SHA256

          aba19501a8033495664879e09e60e4788537d387cf038fa8769e5b178bccdcb4

          SHA512

          f283b721b27d85fbc7a4e1e91ab1683da0c3888f632873625c4c2b48caa170471aaa84e107230988f615d3f43e40a640607d6e6f641aed59788dee441801748a

          Download Submit

        • \Users\Admin\AppData\Local\Temp\{EB7FC0AE-F40B-4a38-982D-D4C2E3D586DC}.tmp\NetBridge.dll
          Filesize

          231KB

          MD5

          9d145902fb5b9a6da62ac85761434e31

          SHA1

          c817d77f59e3767d75cf5f5298d6b5711308f7e5

          SHA256

          98d795d55329b1057f4fd590468e648a8c34b620207fd9a0a6953f3e98d1ea43

          SHA512

          bbb3109bcd5ded909bfdaeb7f4f006fc5928a9bc501bad5ae8ba9805bc0d924a2c4da8bbd215480db936d663852abd9b0435fa241a40224a4cd93c4b7aff79a9

          Download Submit

        • memory/1520-39-0x0000000000210000-0x0000000000211000-memory.dmp

          Filesize

          4KB

          Download