Analysis

  • max time kernel
    106s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-10-2024 00:31

General

  • Target

    2024-10-09_64a28dcc00a853565f4319096e685cc4_magniber.exe

  • Size

    3.9MB

  • MD5

    64a28dcc00a853565f4319096e685cc4

  • SHA1

    05a655b4b2a5b66c6d629eede0bff0156e7c6a2e

  • SHA256

    924cf0d9c911ed3f13923836a2800d77128130fa2085097a301c81ee8d1d2726

  • SHA512

    9388c78f6cc20f741a766ac1b06cae02518c98d96ec9959fdeca19742e15b13db10b7438fa3d597f9d591297158a5c78c93097d8e9262fc4363e193d59e62745

  • SSDEEP

    49152:PuyQz6ISCnS/djRooJTK7sY7vvvUcwAfUOoYaKggtMt+tK+7xzy1AyBS9osN8864:P86ISCnqjn7Y7v3UcwOwBAvA

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-09_64a28dcc00a853565f4319096e685cc4_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-09_64a28dcc00a853565f4319096e685cc4_magniber.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5036
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-10-09_64a28dcc00a853565f4319096e685cc4_magniber.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2256

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpA2BB.tmp

    Filesize

    20KB

    MD5

    49693267e0adbcd119f9f5e02adf3a80

    SHA1

    3ba3d7f89b8ad195ca82c92737e960e1f2b349df

    SHA256

    d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

    SHA512

    b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

  • memory/2256-10-0x00000000058E0000-0x0000000005930000-memory.dmp

    Filesize

    320KB

  • memory/2256-5-0x000000007430E000-0x000000007430F000-memory.dmp

    Filesize

    4KB

  • memory/2256-11-0x0000000074300000-0x0000000074AB0000-memory.dmp

    Filesize

    7.7MB

  • memory/2256-13-0x00000000069E0000-0x0000000006F0C000-memory.dmp

    Filesize

    5.2MB

  • memory/2256-12-0x0000000005880000-0x000000000588A000-memory.dmp

    Filesize

    40KB

  • memory/2256-6-0x00000000057E0000-0x0000000005872000-memory.dmp

    Filesize

    584KB

  • memory/2256-7-0x0000000005EF0000-0x0000000006494000-memory.dmp

    Filesize

    5.6MB

  • memory/2256-8-0x0000000005B10000-0x0000000005CD2000-memory.dmp

    Filesize

    1.8MB

  • memory/2256-9-0x0000000005940000-0x00000000059B6000-memory.dmp

    Filesize

    472KB

  • memory/2256-4-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB

  • memory/2256-1-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB

  • memory/2256-3-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB

  • memory/2256-0-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB

  • memory/2256-14-0x0000000006570000-0x000000000658E000-memory.dmp

    Filesize

    120KB

  • memory/2256-15-0x0000000006660000-0x00000000066C6000-memory.dmp

    Filesize

    408KB

  • memory/2256-2-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB

  • memory/2256-33-0x0000000007FA0000-0x0000000007FAA000-memory.dmp

    Filesize

    40KB

  • memory/2256-35-0x000000007430E000-0x000000007430F000-memory.dmp

    Filesize

    4KB

  • memory/2256-36-0x0000000074300000-0x0000000074AB0000-memory.dmp

    Filesize

    7.7MB

  • memory/2256-37-0x0000000005A20000-0x0000000005A32000-memory.dmp

    Filesize

    72KB

  • memory/2256-38-0x0000000005D20000-0x0000000005D5C000-memory.dmp

    Filesize

    240KB