Analysis
- max time kernel
93s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 20:14
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe
Resource
win7-20240215-en
windows7-x64
14 signatures
150 seconds
General
- Target 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe
- Size 10.1MB
- Sample240603-yz8fdahe56
- SHA256 90182889db1b62bb04c49d1e40a34d806dc01366dedc4fe6b16fcecdf322c888
- MD5 de32ff454d4ae8a8d94844c06eb9529b
- SHA1 b6a709a4fbfab44274a2a1e099f1a8b31c6cb3ff
- SHA512 a8fa19b0a6feb361bc90ccb75f657be5e8b1df23966ff2832a9f525817332de3d0c39b5eab73104efdfc225fcb32a1f37223ec9095189c7392ab953e6d41806d
- SSDEEP 196608:ldad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:zadCoXrlAJ7N3pXW2uGzy
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1808 lite_installer.exe 4200 seederexe.exe 11860 sender.exe - Loads dropped DLL 10 IoCs
pid Process 2428 MsiExec.exe 2428 MsiExec.exe 2428 MsiExec.exe 2428 MsiExec.exe 2428 MsiExec.exe 2428 MsiExec.exe 2428 MsiExec.exe 2428 MsiExec.exe 2428 MsiExec.exe 2428 MsiExec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\N: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\V: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\W: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\R: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\E: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\S: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\T: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\U: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\P: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\Y: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\A: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\J: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\O: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\K: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\Q: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\X: 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe - Drops file in Windows directory 17 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI3AD1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI39F4.tmp msiexec.exe File created C:\Windows\Installer\e573662.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI37E9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3819.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI3878.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI38A8.tmp msiexec.exe File opened for modification C:\Windows\Installer\e573662.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI379A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI38E7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3976.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3A62.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3917.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{5B964E0E-B9A3-4276-9ED9-4D5A5720747A} msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\SearchScopes seederexe.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Internet Explorer\Main seederexe.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe 1480 msiexec.exe 1480 msiexec.exe 1808 lite_installer.exe 1808 lite_installer.exe 4200 seederexe.exe 4200 seederexe.exe 11860 sender.exe 11860 sender.exe 1808 lite_installer.exe 1808 lite_installer.exe - Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeShutdownPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeIncreaseQuotaPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeSecurityPrivilege 1480 msiexec.exe Token: SeCreateTokenPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeAssignPrimaryTokenPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeLockMemoryPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeIncreaseQuotaPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeMachineAccountPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeTcbPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeSecurityPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeTakeOwnershipPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeLoadDriverPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeSystemProfilePrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeSystemtimePrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeProfSingleProcessPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeIncBasePriorityPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeCreatePagefilePrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeCreatePermanentPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeBackupPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeRestorePrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeShutdownPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeDebugPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeAuditPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeSystemEnvironmentPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeChangeNotifyPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeRemoteShutdownPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeUndockPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeSyncAgentPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeEnableDelegationPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeManageVolumePrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeImpersonatePrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeCreateGlobalPrivilege 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe 2644 2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1480 wrote to memory of 2428 1480 msiexec.exe 87 PID 1480 wrote to memory of 2428 1480 msiexec.exe 87 PID 1480 wrote to memory of 2428 1480 msiexec.exe 87 PID 2428 wrote to memory of 1808 2428 MsiExec.exe 88 PID 2428 wrote to memory of 1808 2428 MsiExec.exe 88 PID 2428 wrote to memory of 1808 2428 MsiExec.exe 88 PID 2428 wrote to memory of 4200 2428 MsiExec.exe 90 PID 2428 wrote to memory of 4200 2428 MsiExec.exe 90 PID 2428 wrote to memory of 4200 2428 MsiExec.exe 90 PID 4200 wrote to memory of 11860 4200 seederexe.exe 95 PID 4200 wrote to memory of 11860 4200 seederexe.exe 95 PID 4200 wrote to memory of 11860 4200 seederexe.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_de32ff454d4ae8a8d94844c06eb9529b_magniber.exe"1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2644
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 297AEC70525A1E8C8EE405164CA277B42⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\F241AE81-3140-479A-83A0-DDBBDD74C666\lite_installer.exe"C:\Users\Admin\AppData\Local\Temp\F241AE81-3140-479A-83A0-DDBBDD74C666\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1808
-
-
C:\Users\Admin\AppData\Local\Temp\73D48B77-4CD3-4CDF-A42E-1AFDD16E6DCE\seederexe.exe"C:\Users\Admin\AppData\Local\Temp\73D48B77-4CD3-4CDF-A42E-1AFDD16E6DCE\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\8CB531C9-1107-462F-A13B-A2D4C7C8EBC5\sender.exe" "--is_elevated=yes" "--ui_level=5" "--good_token=x" "--no_opera=n"3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\8CB531C9-1107-462F-A13B-A2D4C7C8EBC5\sender.exeC:\Users\Admin\AppData\Local\Temp\8CB531C9-1107-462F-A13B-A2D4C7C8EBC5\sender.exe --send "/status.xml?clid=6505886&uuid=78df601f-1e81-442f-95b2-d759048f9b8c&vnt=Windows 10x64&file-no=8%0A15%0A25%0A45%0A57%0A59%0A102%0A111%0A125%0A129%0A"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:11860
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e573663.rbs
- Size 575B
- SHA256 e89db102f0b01c05a833c015dd168cf67b48bbad85fa50997d1f854f4d6dbac4
- MD5 50065f4c76c9dc5d30c0281184b06da8
- SHA1 3660264d96d55a757d4a766740b89b613b0728e6
- SHA512 e6afde7a4515e5ce6cf26a884649248c0b9c68cb2fe6e34b60b3dd2c2a6f633429a9796b1d527683b3f4725a5c5bb9c3c94020dc78fcd04d407bf1d0d5c07d41
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
- Size 1KB
- SHA256 0a92882810386113b2a1f7c9cd3d2e119e707a3c13255670e65875287d497031
- MD5 5da384232867404e431e556cc79dc4f7
- SHA1 fdcde299d5d439eff9e0fdfeb3a8700ede4596ac
- SHA512 f032c04927e4480e52e4ead306e1148ac4ab6772869f0d60fecb097ff540ad302b4240b9d749d0d2167b40449f24ad0dc35e0c27e265475abf5c12b8f9422643
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 1KB
- SHA256 5fe61a1f87db9486fdf2e962761ac06d27a5c0ae443c85b081fc3dffe72a7473
- MD5 13b4d9921da7cd45e404e48a7190e21a
- SHA1 27c8e5714ba3afbf1b8710d2e7e718d31057a6fc
- SHA512 6d09d61b633e4b2ddb755efebb9985db201778bb1c9d7444e71edde66ffe0f7d3a7c32c33c3d321b4208c6ffda42b664ee70d7e3ffeb6c520aabecab833d532c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
- Size 536B
- SHA256 ff1f0ea56cf3d17c738dbae87b502b2fefd6ec4a250f0f8cd6e2c86ce8727b81
- MD5 0cdbe93af8a0f6ca2ef227efec65f3d7
- SHA1 a7d052d633cc212c556cd082ead66651169755c5
- SHA512 1a43d99b8a758b80f561bf2b507de5347042453705cbe73f62569e799d3a8181481e476ab9119cc08b3a27d738aabf420ae2454df2723ea5dffe7e3a87976230
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 536B
- SHA256 bf80b5b292b7dadd8bf01284417a11c8a69c07c1100f1204b10474c59d4fedd5
- MD5 2d5d8d577ac187856a93209024fe54ae
- SHA1 817a09bb675e31a50b0b128f9e2b42a5da0ba470
- SHA512 ed0411df9e9f2f249d4170bb7b89a7c5327ba1818fffb0d65a55e7562cda5200710dbc07aa99d8cfc25c486b944a82ce697b2eb77093b7f6b70b512404d78ff9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\73D48B77-4CD3-4CDF-A42E-1AFDD16E6DCE\seederexe.exe
- Size 8.6MB
- SHA256 35585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797
- MD5 225ba20fa3edd13c9c72f600ff90e6cb
- SHA1 5f1a9baa85c2afe29619e7cc848036d9174701e4
- SHA512 97e699cffe28d3c3611570d341ccbc1a0f0eec233c377c70e0e20d4ed3b956b6fe200a007f7e601a5724e733c97eaddc39d308b9af58d45f7598f10038d94ab3
- SSDEEP 196608:44T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:4CoXrlAJ7N3pXW2uGzy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\8CB531C9-1107-462F-A13B-A2D4C7C8EBC5\sender.exe
- Size 260KB
- SHA256 36022c6ecb3426791e6edee9074a3861fe5b660d98f2b2b7c13b80fe11a75577
- MD5 f1a8f60c018647902e70cf3869e1563f
- SHA1 3caf9c51dfd75206d944d4c536f5f5ff8e225ae9
- SHA512 c02dfd6276ad136283230cdf07d30ec2090562e6c60d6c0d4ac3110013780fcafd76e13931be53b924a35cf473d0f5ace2f6b5c3f1f70ce66b40338e53d38d1e
- SSDEEP 6144:HivzZ4S0lBeFv/XSI/yhFrWLygHmWGYzZ/4hJOnN:CvzZ4SuBeFvPSnkygvGYzih8n
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\F241AE81-3140-479A-83A0-DDBBDD74C666\lite_installer.exe
- Size 419KB
- SHA256 688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc
- MD5 aafdfaa7a989ddb216510fc9ae5b877f
- SHA1 41cf94692968a7d511b6051b7fe2b15c784770cb
- SHA512 6e2b76ff6df79c6de6887cf739848d05c894fbd70dc9371fff95e6ccd9938d695c46516cb18ec8edd01e78cad1a6029a3d633895f7ddba4db4bf9cd39271bd44
- SSDEEP 6144:bahey96oZyvBupY5/af/l27Y547CaPWJTfnOMhym0Wk57YG2F89UUZEfk7:bry96RvBj0C7CaPWNPrHCt9UUZa6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
- Size 34KB
- SHA256 72052f546753e84fccfdbd632bf9506ee551d0b8c4f551a3b86b3ccbdcfdf713
- MD5 9130189d23493051519409a634f4c758
- SHA1 3298c6281209fc4f3bf9d6c758b96b1cf2e17776
- SHA512 ef7c7f56cf52c2b4b38aa9d5991536ac865f816dde6c6ea74cc9d9325dabf9d0dbcc4791689d1fbe30c23cd22d0ca7021370a6e602225655a9f18ee9c6f1ccc3
- SSDEEP 768:iZtXY6exFR1QyPHEaRPFqXWPvDmoEx0fc/aUWF0ByPESGl7ZiRtqwIwWOmzkKx:F1lH3FqXWPvDmxu0Sz+y8jiRtqwIwWOM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
- Size 531B
- SHA256 1b25eab8df3344561b28ad9d92c45c58690083f72d1899d439da3e22b9999bf6
- MD5 cc63d2fe1ee4bcd38188b92e51fbe05d
- SHA1 5edbf7fdf28ad044ad89381b66d6b984e668855c
- SHA512 580559f7ccd9b9431b0398583ed6061f529d9d715f2651e1fdef824db20d83989b95b14e8c31ac68b3d06ba2007a60c5767fe2bdc594be28aacc1c700e573c09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\omnija-20241403.zip
- Size 40.8MB
- SHA256 36e682f419c2b5d8e7c285d36088b56d59df3869dbd181943280696d4ca391ca
- MD5 dc5128fcb8d7f6b849f1166532db2dc8
- SHA1 8427501d440d5edbbb2662294bc5650d2bc8aab5
- SHA512 bcf0d463ed4f01a313b8e6be745ad55b42108be84cc5850c411dec19aa7c6d996782da49fc208559f1188941bdd1082d954cfa316f08c0ad2efcf0662952e524
- SSDEEP 98304:WEs4Psp//fq/IHfmabWaJqckq8IscRJK9VdXboNtxdzA8jJ38tPa4Px1CpgrDF/a:G/fq/Ipya6q8DccXitxdHJVCCpg3xVc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
- Size 510B
- SHA256 b5886afd5ecacee66832fcebe9ba8e3e9a012963536b2ffcbe5ea2b9cbb4b7ec
- MD5 684d6d06e8a614dfdab588f038e05384
- SHA1 683b2e70e0e6834a04fc5ed40a283c6b5d2d76cf
- SHA512 e6d1aece0dbcbca04fbf32d78aca2b23c05b5beab4b81c003b0262766fdf7863b0c5385c82447ba5e310b8b69388fe79e986f14a97a577e1c5466ef2564271ef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
- Size 9.8MB
- SHA256 cb44bbaa1db20fea8502331f39408c1999fecad1bf66a8e3c6597d653bf49113
- MD5 49c4faeecc9e80552981c37732652058
- SHA1 ef22ffda0e2bef44e11a1ffa2dfbffd543caa1c1
- SHA512 f1783a9f96b59273fc9751ec54237a04f7ab281dd5af580d66ac95e55a8674f571e83e311c67064fc1a9caf609bd9ea5f7339d4be0c384f9ce88bd3cbff7b532
- SSDEEP 196608:Odad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq4:CadCoXrlAJ7N3pXW2uGzy4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nnr09ubh.Admin\places.sqlite-20240603201442.928472.backup
- Size 68KB
- SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
- MD5 314cb7ffb31e3cc676847e03108378ba
- SHA1 3667d2ade77624e79d9efa08a2f1d33104ac6343
- SHA512 dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5
- SSDEEP 48:TV6UcMtYJqqEgbEwq3hF+gBNxw2BAl7FdickdaxL5HoVQJlu:x6HkTBB2ljvoS0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-20240603201443.053457.backup
- Size 1KB
- SHA256 2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335
- MD5 3adec702d4472e3252ca8b58af62247c
- SHA1 35d1d2f90b80dca80ad398f411c93fe8aef07435
- SHA512 7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-20240603201443.053457.backup
- Size 313B
- SHA256 ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c
- MD5 af006f1bcc57b11c3478be8babc036a8
- SHA1 c3bb4fa8c905565ca6a1f218e39fe7494910891e
- SHA512 3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Yandex\ui
- Size 38B
- SHA256 32c15530d6b50866f15a6a18b2c1cb3bf24cd93fa89b0c298bc92d9ebcb27bc4
- MD5 01879ace01ac3e459c328542c8374fd6
- SHA1 a67f6d25a4d4db90e600355aa1017ce7c22110bd
- SHA512 c8b70afff55c146e7694fe2df2e30786950217de5ada3d1964dcb3c16dab5d10aba5aaf018f94a4e58ab49638b84308082547c2c958777193a9f7ceca8118934
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI379A.tmp
- Size 181KB
- SHA256 a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86
- MD5 0c80a997d37d930e7317d6dac8bb7ae1
- SHA1 018f13dfa43e103801a69a20b1fab0d609ace8a5
- SHA512 fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5
- SSDEEP 3072:LIgxsEwKIE4SaX1xQrlm4taQqPvvNCqv8bcDR0wYyMP3XrZ+bx0PWWX+xA6QpS:LIgxsEbIE45ArptaQqPtCG8SR0waB7Bo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI37E9.tmp
- Size 189KB
- SHA256 669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2
- MD5 e6fd0e66cf3bfd3cc04a05647c3c7c54
- SHA1 6a1b7f1a45fb578de6492af7e2fede15c866739f
- SHA512 fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb
- SSDEEP 3072:iAJayVkvIkE3fqPDgvlevYwlv57GqosaJlpJKzhY9A3w9FtGJ2EYJxZi5V2O2M:ickvIDvWgvlevYwFVaJlp8z++bnYsX2Y
- MD5 SHA1 SHA512 SSDEEP