Analysis

  • max time kernel
    117s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11-06-2024 14:52

General

  • Target

    2024-06-11_508f7915db69fecd601919c7be1927f3_magniber.exe

  • Size

    10.0MB

  • MD5

    508f7915db69fecd601919c7be1927f3

  • SHA1

    0127aa96fd943482e5f4008e0ec0db7e536c27f3

  • SHA256

    08e7bad37cd03fff82ec91a007fcc9b568954548f3b9bc8efe4a850a4435920c

  • SHA512

    7adcc20d54e3f5d3622952b4c714d31068adcd2ab71d85d7e71967543e18def07210da07da21523863e8cd168d7f9829958a5527975ebbe08319cb53cc836098

  • SSDEEP

    196608:CrwirpjXloa5PGT7DoN9dvPmpUV5J9CcVA83mVF/q4mtnzie:Crth2a5e295e+bJ9Cz/q4mtnR

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies system certificate store 2 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-11_508f7915db69fecd601919c7be1927f3_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-11_508f7915db69fecd601919c7be1927f3_magniber.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Modifies system certificate store
    PID:1252

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar806D.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\{2198776D-12F4-48c1-9753-18D4628C6ED2}.tmp\7z.dll

    Filesize

    1.1MB

    MD5

    510b4fb31400e4d222dda77e4ebaa734

    SHA1

    722672630d14fb58388bb571417786210a969c86

    SHA256

    43ab16e268342796e773b516c6062db70d04fea647ec5a63199ce5c4f125f9ad

    SHA512

    592cabeac8046d6811f5d37858c9370b929efa6a10180e9d5bc702eba01429d12c47b808efe7013ba4918591ae25a2134a0dfa4a8842f80a8b34d675fbb5ea11

  • \Users\Admin\AppData\Local\Temp\{8505AD47-C2ED-4b19-9FC7-67060C23CC13}.tmp\360NetUL.dll

    Filesize

    237KB

    MD5

    e965ae5ece45e7951050fbd4c8e6dfa1

    SHA1

    7dbac716a97758652fcd0c64c3a058e0b23e3b58

    SHA256

    57da4c2a9b303cdbef17a9937a983a67ea9d32f8c7474077f300bedb03887520

    SHA512

    0ab2108de1614fcc066a4e5982368ad39145b6aa1b073969f859bfe47440b876fd8b48dcdf986b6359d67701e6c3bb080745d78fec82f37e29c64a4daa8cc367

  • memory/1252-86-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

    Filesize

    4KB

  • memory/1252-87-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

    Filesize

    4KB