Analysis

  • max time kernel
    138s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-10-2024 00:31

General

  • Target

    2024-10-09_64a28dcc00a853565f4319096e685cc4_magniber.exe

  • Size

    3.9MB

  • MD5

    64a28dcc00a853565f4319096e685cc4

  • SHA1

    05a655b4b2a5b66c6d629eede0bff0156e7c6a2e

  • SHA256

    924cf0d9c911ed3f13923836a2800d77128130fa2085097a301c81ee8d1d2726

  • SHA512

    9388c78f6cc20f741a766ac1b06cae02518c98d96ec9959fdeca19742e15b13db10b7438fa3d597f9d591297158a5c78c93097d8e9262fc4363e193d59e62745

  • SSDEEP

    49152:PuyQz6ISCnS/djRooJTK7sY7vvvUcwAfUOoYaKggtMt+tK+7xzy1AyBS9osN8864:P86ISCnqjn7Y7v3UcwOwBAvA

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-09_64a28dcc00a853565f4319096e685cc4_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-09_64a28dcc00a853565f4319096e685cc4_magniber.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-10-09_64a28dcc00a853565f4319096e685cc4_magniber.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp7A31.tmp

    Filesize

    20KB

    MD5

    c9ff7748d8fcef4cf84a5501e996a641

    SHA1

    02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

    SHA256

    4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

    SHA512

    d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

  • memory/2708-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2708-2-0x00000000000D0000-0x0000000000196000-memory.dmp

    Filesize

    792KB

  • memory/2708-6-0x00000000000D0000-0x0000000000196000-memory.dmp

    Filesize

    792KB

  • memory/2708-11-0x00000000000D0000-0x0000000000196000-memory.dmp

    Filesize

    792KB

  • memory/2708-13-0x00000000000D0000-0x0000000000196000-memory.dmp

    Filesize

    792KB

  • memory/2708-12-0x00000000000D0000-0x0000000000196000-memory.dmp

    Filesize

    792KB

  • memory/2708-9-0x00000000000D0000-0x0000000000196000-memory.dmp

    Filesize

    792KB

  • memory/2708-4-0x00000000000D0000-0x0000000000196000-memory.dmp

    Filesize

    792KB