Analysis

  • max time kernel
    141s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/11/2024, 23:27

General

  • Target

    2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe

  • Size

    7.1MB

  • MD5

    cd4e0696f981277d3f3513f34549f125

  • SHA1

    43fa109b18d953344faae6afb987809a9a0a266a

  • SHA256

    59cf20a6b5ad5973b75fe12431bb5e3455650cc3176cef5aeaca0e7da7cb09ee

  • SHA512

    87f160cea14d958950010142d49f49b7522bbe1625665a56830b5c77b405627cc79405af235d0a238eaad7627774a009231527e7678b712b7b365090316cac86

  • SSDEEP

    98304:n9xyitjorTcHhK3Dcwbp2VMprvrGD7nTsR:mp/cHhw2MR

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\SysWOW64\sysx32.exe
      C:\Windows\system32\sysx32.exe /scan
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      PID:2728
    • C:\Users\Admin\AppData\Local\Temp\_2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe
      C:\Users\Admin\AppData\Local\Temp\_2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Users\Admin\AppData\Local\Temp\_2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe
        C:\Users\Admin\AppData\Local\Temp\_2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe --type=collab-renderer --proc=2736
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2824

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\_2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe

          Filesize

          7.1MB

          MD5

          05fc7907ae77304429f2099533e39e73

          SHA1

          f3e98ee40c9473d64222e4ecb783aa5234767719

          SHA256

          ee5a827a0d216ea35652c121ec85be227832e81592f4eeb6ea78012f0a6ce207

          SHA512

          6e7a56b53b73aaa1dfcc1ef721bf421f557872d2222db3cb43ee78ac4ca22eae2f1b2dd53eeec332e15262efd1cef778662b164a41d58570f43348730cc8d93d

        • \Windows\SysWOW64\sysx32.exe

          Filesize

          7.1MB

          MD5

          cd4e0696f981277d3f3513f34549f125

          SHA1

          43fa109b18d953344faae6afb987809a9a0a266a

          SHA256

          59cf20a6b5ad5973b75fe12431bb5e3455650cc3176cef5aeaca0e7da7cb09ee

          SHA512

          87f160cea14d958950010142d49f49b7522bbe1625665a56830b5c77b405627cc79405af235d0a238eaad7627774a009231527e7678b712b7b365090316cac86

        • memory/1088-0-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/1088-11-0x00000000001B0000-0x00000000001C1000-memory.dmp

          Filesize

          68KB

        • memory/1088-10-0x00000000001B0000-0x00000000001C1000-memory.dmp

          Filesize

          68KB

        • memory/1088-21-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/2728-22-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB