Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 05:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe
-
Size
293KB
-
MD5
62613aa47bd56fbe429f67042d308324
-
SHA1
6b65041823c6d7194eb09bfab63a60d4ba47576a
-
SHA256
500309beebda5ac4ead2222ac5bf7b6cae5203f07d283e204d5cbbad612d6fad
-
SHA512
a23bcb4b1ed86a99d441cb9eb7f5c164dbf92ae243455874be0a48cf26edb48357e0bd4efc20c6befea6b4a0dd9c426172c019e1d1d72cb0d73b1d3761609c7e
-
SSDEEP
3072:2qviezBmYQZhG93v9F5pxH53E4+VTs7JDuLDHXGUp1I+FF/NQvMQu+j8K/RTP9an:ziez5QZ4lnh7TDu3X+EGRr9K1TOsDR
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1592 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
winmgr.exewinmgr.exepid process 2688 winmgr.exe 2756 winmgr.exe -
Loads dropped DLL 2 IoCs
Processes:
2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exepid process 1888 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe 1888 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-5050259729679027539035209642065\\winmgr.exe" 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-5050259729679027539035209642065\\winmgr.exe" 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe -
Drops file in System32 directory 4 IoCs
Processes:
winmgr.exedescription ioc process File created C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE winmgr.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe winmgr.exe File created C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe winmgr.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE winmgr.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exewinmgr.exedescription pid process target process PID 1468 set thread context of 1888 1468 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe PID 2688 set thread context of 2756 2688 winmgr.exe winmgr.exe -
Drops file in Windows directory 3 IoCs
Processes:
2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exedescription ioc process File opened for modification C:\Windows\M-5050259729679027539035209642065 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe File created C:\Windows\M-5050259729679027539035209642065\winmgr.exe 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe File opened for modification C:\Windows\M-5050259729679027539035209642065\winmgr.exe 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exewinmgr.exedescription pid process target process PID 1468 wrote to memory of 1888 1468 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe PID 1468 wrote to memory of 1888 1468 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe PID 1468 wrote to memory of 1888 1468 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe PID 1468 wrote to memory of 1888 1468 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe PID 1468 wrote to memory of 1888 1468 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe PID 1468 wrote to memory of 1888 1468 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe PID 1468 wrote to memory of 1888 1468 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe PID 1468 wrote to memory of 1888 1468 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe PID 1468 wrote to memory of 1888 1468 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe PID 1468 wrote to memory of 1888 1468 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe PID 1888 wrote to memory of 1592 1888 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe cmd.exe PID 1888 wrote to memory of 1592 1888 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe cmd.exe PID 1888 wrote to memory of 1592 1888 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe cmd.exe PID 1888 wrote to memory of 1592 1888 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe cmd.exe PID 1888 wrote to memory of 2688 1888 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe winmgr.exe PID 1888 wrote to memory of 2688 1888 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe winmgr.exe PID 1888 wrote to memory of 2688 1888 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe winmgr.exe PID 1888 wrote to memory of 2688 1888 2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe winmgr.exe PID 2688 wrote to memory of 2756 2688 winmgr.exe winmgr.exe PID 2688 wrote to memory of 2756 2688 winmgr.exe winmgr.exe PID 2688 wrote to memory of 2756 2688 winmgr.exe winmgr.exe PID 2688 wrote to memory of 2756 2688 winmgr.exe winmgr.exe PID 2688 wrote to memory of 2756 2688 winmgr.exe winmgr.exe PID 2688 wrote to memory of 2756 2688 winmgr.exe winmgr.exe PID 2688 wrote to memory of 2756 2688 winmgr.exe winmgr.exe PID 2688 wrote to memory of 2756 2688 winmgr.exe winmgr.exe PID 2688 wrote to memory of 2756 2688 winmgr.exe winmgr.exe PID 2688 wrote to memory of 2756 2688 winmgr.exe winmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_62613aa47bd56fbe429f67042d308324_magniber.exe"2⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tqlfcuzuyx.bat" "3⤵
- Deletes itself
PID:1592 -
C:\Windows\M-5050259729679027539035209642065\winmgr.exeC:\Windows\M-5050259729679027539035209642065\winmgr.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\M-5050259729679027539035209642065\winmgr.exeC:\Windows\M-5050259729679027539035209642065\winmgr.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2756
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
278B
MD5495c142584106a5dcdf926911f325d0c
SHA1fb069d283497fe1c88bc28f2a381187d4e50cc07
SHA256289a73e997fc189b7b8ac4945287e97fd2cc8cb8a58bda9bc9db7c3e60d33342
SHA512860269b8d6f58ca5124464952ae0ca964764c91c426641abc810e5fc237bc6ab1e3707bd10e0382742ea9e12dc9c8419a31743a844929e8a82cec5074aee136e
-
Filesize
293KB
MD562613aa47bd56fbe429f67042d308324
SHA16b65041823c6d7194eb09bfab63a60d4ba47576a
SHA256500309beebda5ac4ead2222ac5bf7b6cae5203f07d283e204d5cbbad612d6fad
SHA512a23bcb4b1ed86a99d441cb9eb7f5c164dbf92ae243455874be0a48cf26edb48357e0bd4efc20c6befea6b4a0dd9c426172c019e1d1d72cb0d73b1d3761609c7e