9887f152a97431dc464dbf4aa0aba38d473c6e43e2c42267d15a4d5023f4bb1c

General

Target

2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe
Size

1.4MB
MD5

70b79fe6d6770d469cb3c649906614fd
SHA1

611c831370637cdd7fb8edd14baf921865d9a3ab
SHA256

9887f152a97431dc464dbf4aa0aba38d473c6e43e2c42267d15a4d5023f4bb1c
SHA512

eff6eb9ba973ea444d8d06fb45da539b99b98470fe92217b117f405f206b9a4d35c64463aec9f65274d80c86dd576bc5aa1630d2927c5e041b78ed16b56ec862
SSDEEP

24576:HaQeEZTi8OaYknOkaa+Yv4VRPonb/XOMRv3UFu+d7xB6RXRrK0i4W7rQMHf2MG:HacZTZvO1IFbfOMRv3/K2XZKWWoAOMG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1720	~wr6alb0pt6.tmp

Loads dropped DLL 1 IoCs

pid	Process
2064	2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
2848	MSIEXEC.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~wr6alb0pt6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2848	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2848	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2848	MSIEXEC.EXE
2848	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1720	2064	2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe	30
PID 2064 wrote to memory of 1720	2064	2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe	30
PID 2064 wrote to memory of 1720	2064	2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe	30
PID 2064 wrote to memory of 1720	2064	2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe	30
PID 2064 wrote to memory of 1720	2064	2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe	30
PID 2064 wrote to memory of 1720	2064	2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe	30
PID 2064 wrote to memory of 1720	2064	2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe	30
PID 1720 wrote to memory of 2848	1720	~wr6alb0pt6.tmp	32
PID 1720 wrote to memory of 2848	1720	~wr6alb0pt6.tmp	32
PID 1720 wrote to memory of 2848	1720	~wr6alb0pt6.tmp	32
PID 1720 wrote to memory of 2848	1720	~wr6alb0pt6.tmp	32
PID 1720 wrote to memory of 2848	1720	~wr6alb0pt6.tmp	32
PID 1720 wrote to memory of 2848	1720	~wr6alb0pt6.tmp	32
PID 1720 wrote to memory of 2848	1720	~wr6alb0pt6.tmp	32

C:\Users\Admin\AppData\Local\Temp\2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\~wr6alb0pt6.tmp
  "C:\Users\Admin\AppData\Local\Temp\~wr6alb0pt6.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    MSIEXEC.EXE /i "http://pliuht.cdnpckgs.eu/client/pkgs/lasvegasusa/Las Vegas USA Casino20160401094423.msi" DDC_DID=6478862 DDC_RTGURL=http://www.cdnfile.eu/dl/TrackSetup/TrackSetup.aspx?DID=6478862%26filename=LasVegasUSACasino%2Eexe%26CASINONAME=lasvegasusa DDC_DOWNLOAD_AFFID=NULL DDC_UPDATESTATUSURL=http://190.112.221.40:8080/lvcasino/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://190.112.221.40:8080/lvcasino/Lobby.WebSite/SignUpUnsecure.aspx CUSTOMNAME02=redirectAsData CUSTOMVALUE02=1 CUSTOMNAME03=remoteIP CUSTOMVALUE03=45.35.66.98 CUSTOMNAME04=name CUSTOMNAME05=email CUSTOMNAME06=redirect CUSTOMNAME07=version CUSTOMVALUE07=100 CUSTOMNAME08=camefrom CUSTOMVALUE08=http://www.lasvegasusa.eu/casino/index.php CUSTOMNAME09=adid CUSTOMVALUE09=NULL CUSTOMNAME10=affreferrer CUSTOMVALUE10=http://www.lasvegasusa.eu/casino/index.php SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="~wr6alb0pt6.tmp"
    3⤵
    - Use of msiexec (install) with remote resource
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_isC1FD.tmp

Filesize
1KB

MD5
a3200b5df76a97f81b897e374794ad66

SHA1
ac90eca0754be90b872b026f80632230f6311524

SHA256
53694b3b6e3db5a7f7ab76207347b1fe7e76cf56c76959c9d6ee23a8c4120f32

SHA512
9397e2e2ead01933e043fc79a08d7ca3be601b06e48c6e483f9f8af3e2de1d5e417b4ad4966feb4cb7aac0e40f27a3f46c03c2f303f5acc1eda130f5ccb5caee

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DB1F52E-B311-48E1-841D-FA915497DFCF}\0x0409.ini

Filesize
21KB

MD5
be345d0260ae12c5f2f337b17e07c217

SHA1
0976ba0982fe34f1c35a0974f6178e15c238ed7b

SHA256
e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3

SHA512
77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4DB1F52E-B311-48E1-841D-FA915497DFCF}\_ISMSIDEL.INI

Filesize
20B

MD5
db9af7503f195df96593ac42d5519075

SHA1
1b487531bad10f77750b8a50aca48593379e5f56

SHA256
0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

SHA512
6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~C1EA.tmp

Filesize
6KB

MD5
4846c4d6b1dfb069b5e7620455dc3a65

SHA1
861717615bdc0e296dc817efb9fcdf4b3b325570

SHA256
1280b2ac936e0ae5abd090d9c535335819724b718a36fdf1bc9a6ef995c79fd1

SHA512
7be88f99b7eea34be0243ddde64160608eb0b4cc64562899a8d61b13e0a2f683a2e4dc08d0822a727cf57089f290fd9f4011bee35943036228dfdc4db2868703

Download Submit
\Users\Admin\AppData\Local\Temp\~wr6alb0pt6.tmp

Filesize
1.2MB

MD5
8c645ea0739d78fac6cfff54d951adb6

SHA1
e0640553d719f7bb76488cb8ba8648c9efc5b609

SHA256
f8a09c8fc1eda714ff13f67fcc057e6bd15790cdc1ffac37a134bd108c712ba6

SHA512
41f0b90741076bf53b701def1f0cd0398982c8cec11ca61413a24c484912fad85ff8345b7de5776e7795116b3633154b310c809c92ef74a45527ab1cad332aae

Download Submit

Analysis

Sharing