Analysis
-
max time kernel
95s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2024 16:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe
-
Size
10.2MB
-
MD5
18b5196c49a9611141dd28e90986e4b5
-
SHA1
d0714355ee4eca860a45d08ac33ca1761df828dd
-
SHA256
4994d99b024a69536c6df49657916c91ff00d64d371a27c52be4bf85f45fb037
-
SHA512
b82c3f8c22652dbf2c96e2b8b2b5e4744626c7896918cb12f7b55fbac9d5b3b37af54b68ccad6ed00d6f4aa257e5fcde9fe178e09fbf13f796e86bfc4b5c5421
-
SSDEEP
196608:vdad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvqT:ladCoXrlAJ7N3pXW2uGzyT
Malware Config
Signatures
-
Detects Floxif payload 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023480-1.dat floxif -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0009000000023480-1.dat acprotect -
Executes dropped EXE 3 IoCs
pid Process 4932 lite_installer.exe 1524 seederexe.exe 13960 sender.exe -
Loads dropped DLL 19 IoCs
pid Process 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe 3568 MsiExec.exe 3568 MsiExec.exe 3568 MsiExec.exe 3568 MsiExec.exe 3568 MsiExec.exe 3568 MsiExec.exe 3568 MsiExec.exe 4932 lite_installer.exe 3568 MsiExec.exe 3568 MsiExec.exe 3568 MsiExec.exe 1524 seederexe.exe 3568 MsiExec.exe 13960 sender.exe 13960 sender.exe 13960 sender.exe 13960 sender.exe 13960 sender.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x0009000000023480-1.dat upx behavioral2/memory/1784-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3568-46-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4932-92-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/1524-109-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3568-235-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/1784-239-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/13960-8751-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/1524-8754-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/13960-8775-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4932-8779-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\X: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\M: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\R: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\V: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\N: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\e: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\H: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\T: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\S: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\K: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\J: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\U: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\Y: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\e: sender.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\W: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\Q: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\Z: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe File created \??\c:\progra~1\common~1\system\symsrv.dll.000 sender.exe -
Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e57b239.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB662.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB79F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB82C.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{5B964E0E-B9A3-4276-9ED9-4D5A5720747A} msiexec.exe File opened for modification C:\Windows\Installer\MSIB5E4.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIB6D1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB89B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB919.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB576.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB750.tmp msiexec.exe File created C:\Windows\Installer\e57b239.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB47B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB710.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lite_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language seederexe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sender.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\SearchScopes seederexe.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Main seederexe.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe 2788 msiexec.exe 2788 msiexec.exe 4932 lite_installer.exe 4932 lite_installer.exe 1524 seederexe.exe 1524 seederexe.exe 13960 sender.exe 13960 sender.exe 13960 sender.exe 13960 sender.exe 4932 lite_installer.exe 4932 lite_installer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeShutdownPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeIncreaseQuotaPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeSecurityPrivilege 2788 msiexec.exe Token: SeCreateTokenPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeAssignPrimaryTokenPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeLockMemoryPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeIncreaseQuotaPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeMachineAccountPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeTcbPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeSecurityPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeTakeOwnershipPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeLoadDriverPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeSystemProfilePrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeSystemtimePrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeProfSingleProcessPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeIncBasePriorityPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeCreatePagefilePrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeCreatePermanentPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeBackupPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeRestorePrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeShutdownPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeDebugPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeAuditPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeSystemEnvironmentPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeChangeNotifyPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeRemoteShutdownPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeUndockPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeSyncAgentPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeEnableDelegationPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeManageVolumePrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeImpersonatePrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeCreateGlobalPrivilege 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeDebugPrivilege 3568 MsiExec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeDebugPrivilege 4932 lite_installer.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeDebugPrivilege 1524 seederexe.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe 1784 2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2788 wrote to memory of 3568 2788 msiexec.exe 84 PID 2788 wrote to memory of 3568 2788 msiexec.exe 84 PID 2788 wrote to memory of 3568 2788 msiexec.exe 84 PID 3568 wrote to memory of 4932 3568 MsiExec.exe 85 PID 3568 wrote to memory of 4932 3568 MsiExec.exe 85 PID 3568 wrote to memory of 4932 3568 MsiExec.exe 85 PID 3568 wrote to memory of 1524 3568 MsiExec.exe 87 PID 3568 wrote to memory of 1524 3568 MsiExec.exe 87 PID 3568 wrote to memory of 1524 3568 MsiExec.exe 87 PID 1524 wrote to memory of 13960 1524 seederexe.exe 88 PID 1524 wrote to memory of 13960 1524 seederexe.exe 88 PID 1524 wrote to memory of 13960 1524 seederexe.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_18b5196c49a9611141dd28e90986e4b5_floxif_magniber.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1784
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F6FB611E02A8AD8B3DEA416805925F502⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\228EEB46-05FE-4B95-8609-571AFBF985FA\lite_installer.exe"C:\Users\Admin\AppData\Local\Temp\228EEB46-05FE-4B95-8609-571AFBF985FA\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
C:\Users\Admin\AppData\Local\Temp\2C12974A-6B13-415D-8EAA-2DE47EFAEC96\seederexe.exe"C:\Users\Admin\AppData\Local\Temp\2C12974A-6B13-415D-8EAA-2DE47EFAEC96\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\E88A71F6-63CE-4A94-9849-9884D7501626\sender.exe" "--is_elevated=yes" "--ui_level=5" "--good_token=x" "--no_opera=n"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\E88A71F6-63CE-4A94-9849-9884D7501626\sender.exeC:\Users\Admin\AppData\Local\Temp\E88A71F6-63CE-4A94-9849-9884D7501626\sender.exe --send "/status.xml?clid=9183476&uuid=c9a81f5f-af40-44d0-952a-58a0468c1582&vnt=Windows 10x64&file-no=8%0A15%0A25%0A45%0A57%0A59%0A102%0A111%0A125%0A129%0A"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:13960
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
575B
MD5d925e335f6c4c1c0b980b27400b4ad87
SHA1240a13b3476e66e4db6069e1454495a6d0579901
SHA2568b2a8055b09bdffb0b4ae3fac79ee6998e801d4e3439e4c9f468874c01519e61
SHA5124c16aec19b81dd0466e6c2288922f286a829c49605b5e99caa61f5e12a29a63ba4ca2b97b5ea040e276c67a7de881203329c44d125475a871f627187e73e994e
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
Filesize1KB
MD5b992a5a50818501b9f24bc14a8e6c904
SHA11ee982b9bf8deb20deee3481a055796558345527
SHA256280f8cbaeb4f0b82724fbd1da3a8feb073c0d4c823ed75fcd4ef54653bdfeb56
SHA512354e481ede4f1d9d3fea59bb75240c26e928224f9a49ba3b29152f04ecc96b795b4d06291d50a668ef28301f9a44f04b75afdde072b891fc8547fb65c6f4d58c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Filesize1KB
MD5324464c40a6b0790924ef9ba0c63c899
SHA1df35543f35ec695ce32e03ff8f1156638aa7f205
SHA256075d6b6934bf557764a3f37220ea39f503797d2d37546bd08241d7fd374dc30f
SHA51270ca65f18f5ffa1c711fab4b6c45d976bc2c346e97a82693cdbc68443892d890ff6a29f059c7493fdd46df77485da43b6afeed3a0c961f4cc0c29be89030fdfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
Filesize536B
MD565581f97a26f915860f28a2c83d47e60
SHA1b625579cdf3985b5a0da2fba7ee4815695a3a629
SHA2562a2894dfc75e5cb91263528acca29a88dc7388a47ed7b129ab49a05f7f18ee1a
SHA5120132a2ebb710d4455e548d7b888849270dbeef5e1818f21bb8a576e40551c8deac794bf2c173d677c80ca72de7dc25cc35a73ab540b63b9e15bd797a0c878533
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Filesize536B
MD55daf1322d8b825ed65cc2b23aa534ed5
SHA1a826bffe21409239739881a55c0c18e8cb9909c9
SHA2560f3357e00adf3b739e368546992dfd12f7da5035fd7881d73248ae3bb1c79f12
SHA5123f858dedba9eceabdca7c82756c9c2240a495e8bc2be7024e8e9135f5cf5de29e8042fe99b6b0875932f9c41defda7d0d4882d3faa2dcc508068ea1f559183bc
-
Filesize
419KB
MD5aafdfaa7a989ddb216510fc9ae5b877f
SHA141cf94692968a7d511b6051b7fe2b15c784770cb
SHA256688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc
SHA5126e2b76ff6df79c6de6887cf739848d05c894fbd70dc9371fff95e6ccd9938d695c46516cb18ec8edd01e78cad1a6029a3d633895f7ddba4db4bf9cd39271bd44
-
Filesize
495KB
MD53b876be57c1a35fb00ab3716a32cc744
SHA10ae960957b895f6eeaa143203fa7581e2dbd67f4
SHA256ab5ca08ef035672b847d2445b80f169d96cac26a01b3096812f0cd34659c0226
SHA5129d2e990215c912079d25acc2f8caf5b0d11beb64d39a34f679bcda3576db00a223f0ec9174ff09b4c63b857ac7cd914c4ed55edb04b03ad8a9502b46094ba2c2
-
Filesize
8.6MB
MD5225ba20fa3edd13c9c72f600ff90e6cb
SHA15f1a9baa85c2afe29619e7cc848036d9174701e4
SHA25635585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797
SHA51297e699cffe28d3c3611570d341ccbc1a0f0eec233c377c70e0e20d4ed3b956b6fe200a007f7e601a5724e733c97eaddc39d308b9af58d45f7598f10038d94ab3
-
Filesize
10.1MB
MD5de5cc8b280f3a924e2c3f269fe7618a0
SHA15df9f0fb3c75ade6fd314becf9263249b1b8876e
SHA256167398f1384b8322e60810eaa3cf147e2884580063cb12e19dab484f63a4bbd6
SHA512782500b6140c9f1c5d269b8a269ff5e0515f762f198a60f5b55eaf39eeeee560c3dbc4035a3c83fff0f5889dba38f7621328dd998f90e83cd8ce47cc52432b26
-
Filesize
260KB
MD5f1a8f60c018647902e70cf3869e1563f
SHA13caf9c51dfd75206d944d4c536f5f5ff8e225ae9
SHA25636022c6ecb3426791e6edee9074a3861fe5b660d98f2b2b7c13b80fe11a75577
SHA512c02dfd6276ad136283230cdf07d30ec2090562e6c60d6c0d4ac3110013780fcafd76e13931be53b924a35cf473d0f5ace2f6b5c3f1f70ce66b40338e53d38d1e
-
Filesize
337KB
MD5967a5aabc297800f61cf43cbe773a4ba
SHA14e8d31949ebbe5cbebc3e5c29f24e0aa74f56e80
SHA2560a3b37de2c5d5dffbfaad6e0dbdd9743147d86e78d882c1e4b720e91a400ebbc
SHA5122c0ea7fcf939b28a33806671ab07f8667d23b323cfbfe61e6ca02965a29652537d9badbe2e033d2896d21dd3f999cb9dc22d477d3dbdeab3cd7b0a5c0969ed3e
-
Filesize
34KB
MD5218da52d4ee549d308925fffc19154b2
SHA1652e13e72266c5c50d691420388c569b894e7b45
SHA25694bda758e2307197331f18ef0a25fa6c113b4a15ccf6363b418acf7334dfaf98
SHA512cb5af907fa6acc54b78b7422af1d048bfadbeca4d0eada6b96ed8017ccf34e4e3e6b602db3649cf6b69fade7010ab88450a2b0d07db0ad81ff2224351c99b29c
-
Filesize
531B
MD5f1083a9453af8796ae5b0df6d4e8ce57
SHA12567b4c551c179614d213514bed8ceb20e4f97e8
SHA256637a4d28261e4819483ca7296cf6b6eb5768e2e82b218a3edca4c007b9941788
SHA512fd5993494290326be52da2105ca176c588f490fd9c4a98514178a1459887064b6bd09f4e4168dd1a35a2e5e5b58b887cfc0e595e4b1a8e2a79bc93c2ea1cd880
-
Filesize
42.1MB
MD5bf952b53408934f1d48596008f252b8d
SHA1758d76532fdb48c4aaf09a24922333c4e1de0d01
SHA2562183a97932f51d5b247646985b4e667d8be45f18731c418479bbd7743c825686
SHA512a510a96e17090ada1a107e0f6d4819787652ab3d38cd17237f255c736817c7cfcb3fd5cf25f56d5693f4923375b2ab9548e9215070e252aae25c3528b2186d99
-
Filesize
510B
MD5c528466ba6d4f66966aa31021aa339dc
SHA1ee953f22f33b25d80cbfe250d64fed4d2da80091
SHA256546e928b7127a4515b089f0b913078404b664a5df33c928a281888c25b03760f
SHA512ebd159dbc6f47b6f70e4f47d9de6bc540c86c915c44df7a4dd50c1c6a431303bb06e22382e8a76e9e2399d24263feca64305a74fa4b50314f8b429b141af601c
-
Filesize
9.8MB
MD5db69b41b1827ccc598a416e0d32e4a39
SHA1acc35592e318c32d0f4ac768f32f1f8243ba230c
SHA256b5a4c7a05785ac51553953bf951c284ff03a9ac7d1cba15fa391d0b6c7aed5cc
SHA512d40479e0dd384a99fefbc8a43381dde21b2633320393566ecdb2895fa88008794b996d7fac3ddae102c6dd516cdb3c14e3e52ff7371472cc0894c444a4b4d867
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8luf6ers.Admin\places.sqlite-20240916162345.433797.backup
Filesize68KB
MD5314cb7ffb31e3cc676847e03108378ba
SHA13667d2ade77624e79d9efa08a2f1d33104ac6343
SHA256b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
SHA512dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5
-
Filesize
1KB
MD53adec702d4472e3252ca8b58af62247c
SHA135d1d2f90b80dca80ad398f411c93fe8aef07435
SHA2562b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335
SHA5127562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0
-
Filesize
313B
MD5af006f1bcc57b11c3478be8babc036a8
SHA1c3bb4fa8c905565ca6a1f218e39fe7494910891e
SHA256ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c
SHA5123d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af
-
Filesize
38B
MD51eba76562545965a2a2d609f7bcb4c11
SHA1125317584f36a64b57c05643c1f6d051ec25b108
SHA25647a1796be97f1407ac025ed151be7b701946a7ddc765f612ab33c6bc6d494a5a
SHA51244bc7052a52147365f2116cac7c52bf53bead803d51a34a6b74e182f9f9fd5c429c7a9285adf76f03a4425b539f4a7d8a878bc560e1430dbe33c6bd028523bb6
-
Filesize
181KB
MD50c80a997d37d930e7317d6dac8bb7ae1
SHA1018f13dfa43e103801a69a20b1fab0d609ace8a5
SHA256a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86
SHA512fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5
-
Filesize
189KB
MD5e6fd0e66cf3bfd3cc04a05647c3c7c54
SHA16a1b7f1a45fb578de6492af7e2fede15c866739f
SHA256669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2
SHA512fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0