Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    12-06-2024 13:03

General

  • Target

    2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe

  • Size

    10.1MB

  • MD5

    51d5200e15ebda388c63a38a0d0105ff

  • SHA1

    085e836dd0adb10f3cc7a80270ea729626c32076

  • SHA256

    05e7c78141093b0ca5a02cfec727a5ba40002cc731a589a098f46b221c3240d4

  • SHA512

    64154fc84557c4c1a7f2d764da56d5be3250ec6a9bb9ce2124301fb01fe1e5456b0628ea243775b9f1b1c091763a33fc0d4ed770eb1c61efbf8d5e28fbf5f9a9

  • SSDEEP

    196608:kdad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:AadCoXrlAJ7N3pXW2uGzy

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Blocklisted process makes network request 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1680
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E99F52C97D5EDC0E50208105D7A5D5F5
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1960
      • C:\Users\Admin\AppData\Local\Temp\CDF622A1-7533-4511-B090-618B772D8286\lite_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\CDF622A1-7533-4511-B090-618B772D8286\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1528
      • C:\Users\Admin\AppData\Local\Temp\EADA3D52-9143-4744-95A6-E56D9BD1D276\seederexe.exe
        "C:\Users\Admin\AppData\Local\Temp\EADA3D52-9143-4744-95A6-E56D9BD1D276\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\87FFB23F-AEA1-4335-BDC8-4BB1A0077015\sender.exe" "--is_elevated=yes" "--ui_level=5" "--good_token=x" "--no_opera=n"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2176
        • C:\Users\Admin\AppData\Local\Temp\87FFB23F-AEA1-4335-BDC8-4BB1A0077015\sender.exe
          C:\Users\Admin\AppData\Local\Temp\87FFB23F-AEA1-4335-BDC8-4BB1A0077015\sender.exe --send "/status.xml?clid=2765538&uuid=8f5ed4dd-E937-484D-AD3F-B2743C33ce78&vnt=Windows 7x64&file-no=6%0A15%0A25%0A45%0A57%0A59%0A111%0A125%0A129%0A"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f7615c4.rbs

    Filesize

    575B

    MD5

    eefcfd87c1fe2d765acf67403e2e3be6

    SHA1

    2f1fa9ca39d61e2edaa4ab93d413306dab00fe62

    SHA256

    e5519f7ee24e88180a8ddfc6958a7bb7298e4413c8bf2151ad200982d142f278

    SHA512

    75bf202c44027e142d5cd00e7f2720d145843f315f7571b090891a3ccc7e0710457eab6ccb218b3f9e16abd538e343ee2429440ace6b6151594f27c423ea2a02

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    41fa317293b7999cbe9cb36d722b190a

    SHA1

    40a059e7a83ca2a500084e1e18b66ea7e71c9866

    SHA256

    12451afeac9881719ce5e2b1b0f5787648919d989053eed42774b8cfaab1b6bc

    SHA512

    ddd3bdd73fb0b1722f68835d03068cf2e9976d7a73b834af6dc24b7b030c67070699520c500d36e1c82e3621c40609db5b4f20bbc183277a1700130423fecd99

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    b1c55240454d0b8dfcdc28d36b556e0b

    SHA1

    4520d7b32cd32e130079833e974188fceedddbdc

    SHA256

    11f9c8a690a18881d177dfaa8be3ffb8c006f3f175192b126ffb564eb2bf24d8

    SHA512

    1b6eb98d4728eac2975bafb148e216b886500304e89d005a0148ce00c2a425ae48107c237a8654d06bb59e764b2ca6d83b95863b26e2d3fa454446998194c828

  • C:\Users\Admin\AppData\Local\Temp\OMNIJA~1.ZIP

    Filesize

    41.3MB

    MD5

    1d6cfd7db58008d1b44328c5a3a4220c

    SHA1

    8e8304bfd7a73b9ae8415b6cbd273e612868a2b2

    SHA256

    915e46dcc29d6fee123c4b8e88d846ac95ffd4a6f4eb956dc882d305ee1b8256

    SHA512

    4c17160aa83abeff897462f981226902dd6694817ad95f246511fc63c637bdffa0989a3db00c4309fa673a13b4993c509df538ddad482d1be8b4058749ee93f2

  • C:\Users\Admin\AppData\Local\Temp\Tar12BB.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log

    Filesize

    34KB

    MD5

    14cb1e10be90546068f7a62d7c545e1d

    SHA1

    b9e4ea6ae4e0e5b5a21f7125a9e1867b53120198

    SHA256

    2c4d92013eaf414578ff93df266bda144dd76f2c26696ec958033a5f36330573

    SHA512

    d32500f68653f65b226437d215ab88510733edee371b524288df3d45a77b0d8b5fcfc1fd10dc27cc4c116481928b8a1f5992085333cc22309796f49d5ebe921c

  • C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml

    Filesize

    531B

    MD5

    c569a73140c7682adb47b64117c4144f

    SHA1

    d894792b4dfa7c5f6e696f05fd7dfd9c3f9a2ebd

    SHA256

    761715b9e682b75c6c41c9664263c0cddac295d4725ddf92fe267aac2fc1e54b

    SHA512

    b30001a70cd1265f206bf0c7458791e37d7890d5777fe43ec6c901368b3788efba849ce91c364da47c9084b73382b1eccc8c3614fe7fc9d1b8155021014e46e0

  • C:\Users\Admin\AppData\Local\Temp\[email protected]

    Filesize

    2KB

    MD5

    86ccb9bf54927a2abd93cd38e51593b4

    SHA1

    4bff9876cc7a5233f432bc741d7c6e7d3d715e4d

    SHA256

    03b8edf36c1c48cf1cf29676918cbaab91e015610ae59617a3202e043c1c5c41

    SHA512

    4db33cd3c132e05fabbdc8cf90d500bcdedd37722f6f1a090d4d70621ef57bfe15360f2276fe2bedc64eff4238bb7c5734b3897345f85ebcc8bf963927a96c39

  • C:\Users\Admin\AppData\Local\Temp\vendor00000.xml

    Filesize

    510B

    MD5

    10cdb2ce3fe53937c8a0879033424135

    SHA1

    061e1fc38f7075d0e6b40b00004225f64f046cbd

    SHA256

    1bd0f826e60de8c54b4becd496b5f7b642ec10a3a0c4b827479c7c6e0d50ae00

    SHA512

    4539da3e183e4856614b5baa50f54a384edf3bea4bfebade45c019a046fc2bac94734e019ac3420905707e19907241452f6b72214a373ddfd6a684dd04f67ed7

  • C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi

    Filesize

    9.8MB

    MD5

    a685e7710dfd278be21aad1d88f6037f

    SHA1

    c40bdb55e24180aeb3f94927f4ab857a10bae870

    SHA256

    3274d31cd9e5ee72687e8fc0bd2d53e47cd61301a0a715a572b4c29fcb808ed4

    SHA512

    fd77dc748bfbe53f871f18c3449a7ccc3c9b44a41aff4f2475f5c5a667cdfefd7231a23a723bb9599cdf884473abce42752067201d4aaf6245f65ffd4ebf3375

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.Admin\places.sqlite-20240612130316.477600.backup

    Filesize

    68KB

    MD5

    314cb7ffb31e3cc676847e03108378ba

    SHA1

    3667d2ade77624e79d9efa08a2f1d33104ac6343

    SHA256

    b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1

    SHA512

    dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-20240612130316.540000.backup

    Filesize

    1KB

    MD5

    3adec702d4472e3252ca8b58af62247c

    SHA1

    35d1d2f90b80dca80ad398f411c93fe8aef07435

    SHA256

    2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335

    SHA512

    7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-20240612130316.540000.backup

    Filesize

    313B

    MD5

    af006f1bcc57b11c3478be8babc036a8

    SHA1

    c3bb4fa8c905565ca6a1f218e39fe7494910891e

    SHA256

    ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c

    SHA512

    3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af

  • C:\Users\Admin\AppData\Roaming\Yandex\ui

    Filesize

    36B

    MD5

    fcd2b22794b824ecc92a3823d9a566ce

    SHA1

    174b1519bcf86a7933f0adc7bb0f879a20df4c6d

    SHA256

    693b33530dae478937d2ef2168398c3091ea631fb989f7eeefd8e5f11568342a

    SHA512

    ff2ff171896e1b7ddff526a5f979203583d512b72c0f9cafcd07c20f9ca4cc64704552b01b1689bcfda4c0119ff1e18391b75af459abaf23d7fc03f41beb3730

  • C:\Windows\Installer\MSI19D6.tmp

    Filesize

    181KB

    MD5

    0c80a997d37d930e7317d6dac8bb7ae1

    SHA1

    018f13dfa43e103801a69a20b1fab0d609ace8a5

    SHA256

    a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86

    SHA512

    fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5

  • C:\Windows\Installer\MSI1A83.tmp

    Filesize

    189KB

    MD5

    e6fd0e66cf3bfd3cc04a05647c3c7c54

    SHA1

    6a1b7f1a45fb578de6492af7e2fede15c866739f

    SHA256

    669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2

    SHA512

    fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb

  • \Users\Admin\AppData\Local\Temp\87FFB23F-AEA1-4335-BDC8-4BB1A0077015\sender.exe

    Filesize

    260KB

    MD5

    f1a8f60c018647902e70cf3869e1563f

    SHA1

    3caf9c51dfd75206d944d4c536f5f5ff8e225ae9

    SHA256

    36022c6ecb3426791e6edee9074a3861fe5b660d98f2b2b7c13b80fe11a75577

    SHA512

    c02dfd6276ad136283230cdf07d30ec2090562e6c60d6c0d4ac3110013780fcafd76e13931be53b924a35cf473d0f5ace2f6b5c3f1f70ce66b40338e53d38d1e

  • \Users\Admin\AppData\Local\Temp\CDF622A1-7533-4511-B090-618B772D8286\lite_installer.exe

    Filesize

    419KB

    MD5

    aafdfaa7a989ddb216510fc9ae5b877f

    SHA1

    41cf94692968a7d511b6051b7fe2b15c784770cb

    SHA256

    688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc

    SHA512

    6e2b76ff6df79c6de6887cf739848d05c894fbd70dc9371fff95e6ccd9938d695c46516cb18ec8edd01e78cad1a6029a3d633895f7ddba4db4bf9cd39271bd44

  • \Users\Admin\AppData\Local\Temp\EADA3D52-9143-4744-95A6-E56D9BD1D276\seederexe.exe

    Filesize

    8.6MB

    MD5

    225ba20fa3edd13c9c72f600ff90e6cb

    SHA1

    5f1a9baa85c2afe29619e7cc848036d9174701e4

    SHA256

    35585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797

    SHA512

    97e699cffe28d3c3611570d341ccbc1a0f0eec233c377c70e0e20d4ed3b956b6fe200a007f7e601a5724e733c97eaddc39d308b9af58d45f7598f10038d94ab3