07f71b4324bf652b56e84be9da5ec87831a08e1147389a50d12c69e5c4788ba0

Analysis

max time kernel
91s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 06:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe
Size

3.8MB
MD5

68a0589b6a420dc837ecf367be679674
SHA1

2944341c9781e46655ada59e5489401599a885dd
SHA256

07f71b4324bf652b56e84be9da5ec87831a08e1147389a50d12c69e5c4788ba0
SHA512

6b18112e4266f4f12ef0e5fa7767cc6ec43e612870ed0b80f9cf80158bbbc0636bf4a54b547f20393ef9d8b0d7d75a0cd8f373fc68ada0c78d3bac0791226a52
SSDEEP

98304:2E6tkd0I13Bqzr+lnAv+cKNa+jwCBy7VHBeoFyf:w80IZQP+lAsNTwCBgVHBez

Score

7^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2004	TestMSVCR.exe

Loads dropped DLL 1 IoCs

pid	Process
2064	2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2064	2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe
2064	2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe
2064	2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe
2064	2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2064	2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe
2064	2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2064
- C:\Users\Admin\AppData\Local\Temp\Tencent\SoftMgr\~e572e34\TestMSVCR.exe
  "C:\Users\Admin\AppData\Local\Temp\Tencent\SoftMgr\~e572e34\TestMSVCR.exe" (null)
  2⤵
  - Executes dropped EXE
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tencent\SoftMgr\~e572e34\TestMSVCR.exe

Filesize
48KB

MD5
03c83a8a1bb1a48a0e37a310a8d893f6

SHA1
1360e8610e902469c97003bf51a7d8603d4e2b26

SHA256
68a8e155fc0ff76fd9cbcb7127fee286f3216d9c28779c45861948c57640dc74

SHA512
511e5534464934f26b9cc8ba206526853fb09a31b626ef5da47a0a5460ecb6941868db5de48b2597e451c4de622f19d0a7dba34b41893a14dfda8772c148fe35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tencent\SoftMgr\~e572e34\dr.dll

Filesize
346KB

MD5
47e5db9c8990f133d57c564c20668d38

SHA1
b8d90e8922c71935c61ecaae9a482fba6c3439ba

SHA256
5d14c76dbc223385f34e60391ca91475078c1fe35822bf91f825fc8196d95fcd

SHA512
000608913349ce84ef8eda5f68d03ef74fd57f6a16d74cb5b0945621f281b2396535f42daac33ab7bf94317b783caec9c32edfbaffa4da56c97dbfe9ea084488

Download Submit
memory/2064-7-0x0000000002F40000-0x0000000002F41000-memory.dmp

Filesize
4KB

Download
memory/2064-28-0x0000000002F40000-0x0000000002F41000-memory.dmp

Filesize
4KB

Download