Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 01:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe
-
Size
292KB
-
MD5
5bc38f3130148964d82a642b314c0811
-
SHA1
b9755be3cb6de01745627c288253aeb680d307d6
-
SHA256
a848bf1e584139446ba66896fe01aedf6726ce4e51bdb10b23afab53438c142a
-
SHA512
0cbe3706a9a770aed43a3d5533a3ec183b236d14c4038c69490e719bfed2a835269727f7835256d711b3160bbc5f44d464efb20ab33750051ff26cd8319555bd
-
SSDEEP
3072:jNdkchM4eJY+kPsSNxq8RPCUek4pZhzVB+Nm+5XNtOCq+IYKC9ADQFcgtgVsN6fd:BzhM4em+kPsgzr4tSRq+IYKEA0bN67t7
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2760 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
winmgr.exewinmgr.exepid process 2956 winmgr.exe 2888 winmgr.exe -
Loads dropped DLL 2 IoCs
Processes:
2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exepid process 2604 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe 2604 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-5050259729679027539035209642065\\winmgr.exe" 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-5050259729679027539035209642065\\winmgr.exe" 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe -
Drops file in System32 directory 4 IoCs
Processes:
winmgr.exedescription ioc process File opened for modification C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe winmgr.exe File created C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe winmgr.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE winmgr.exe File created C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE winmgr.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exewinmgr.exedescription pid process target process PID 2324 set thread context of 2604 2324 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe PID 2956 set thread context of 2888 2956 winmgr.exe winmgr.exe -
Drops file in Windows directory 3 IoCs
Processes:
2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exedescription ioc process File created C:\Windows\M-5050259729679027539035209642065\winmgr.exe 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe File opened for modification C:\Windows\M-5050259729679027539035209642065\winmgr.exe 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe File opened for modification C:\Windows\M-5050259729679027539035209642065 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.execmd.exewinmgr.exewinmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winmgr.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exewinmgr.exedescription pid process target process PID 2324 wrote to memory of 2604 2324 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe PID 2324 wrote to memory of 2604 2324 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe PID 2324 wrote to memory of 2604 2324 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe PID 2324 wrote to memory of 2604 2324 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe PID 2324 wrote to memory of 2604 2324 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe PID 2324 wrote to memory of 2604 2324 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe PID 2324 wrote to memory of 2604 2324 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe PID 2324 wrote to memory of 2604 2324 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe PID 2324 wrote to memory of 2604 2324 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe PID 2324 wrote to memory of 2604 2324 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe PID 2604 wrote to memory of 2760 2604 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe cmd.exe PID 2604 wrote to memory of 2760 2604 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe cmd.exe PID 2604 wrote to memory of 2760 2604 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe cmd.exe PID 2604 wrote to memory of 2760 2604 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe cmd.exe PID 2604 wrote to memory of 2956 2604 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe winmgr.exe PID 2604 wrote to memory of 2956 2604 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe winmgr.exe PID 2604 wrote to memory of 2956 2604 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe winmgr.exe PID 2604 wrote to memory of 2956 2604 2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe winmgr.exe PID 2956 wrote to memory of 2888 2956 winmgr.exe winmgr.exe PID 2956 wrote to memory of 2888 2956 winmgr.exe winmgr.exe PID 2956 wrote to memory of 2888 2956 winmgr.exe winmgr.exe PID 2956 wrote to memory of 2888 2956 winmgr.exe winmgr.exe PID 2956 wrote to memory of 2888 2956 winmgr.exe winmgr.exe PID 2956 wrote to memory of 2888 2956 winmgr.exe winmgr.exe PID 2956 wrote to memory of 2888 2956 winmgr.exe winmgr.exe PID 2956 wrote to memory of 2888 2956 winmgr.exe winmgr.exe PID 2956 wrote to memory of 2888 2956 winmgr.exe winmgr.exe PID 2956 wrote to memory of 2888 2956 winmgr.exe winmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-22_5bc38f3130148964d82a642b314c0811_magniber.exe"2⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ikenpsnsvc.bat" "3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2760
-
-
C:\Windows\M-5050259729679027539035209642065\winmgr.exeC:\Windows\M-5050259729679027539035209642065\winmgr.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\M-5050259729679027539035209642065\winmgr.exeC:\Windows\M-5050259729679027539035209642065\winmgr.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2888
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
278B
MD54e4810709bd95fe14e5881bf53527880
SHA10bcae8ba872ff6325c9ba64f31db4647f7464660
SHA2560aba666e964cea193fdb7f54afd4db3eec40658e96d3fd31bede33e243c20f8b
SHA5126f2d948617a1dce8bac419372e46368437e15c1c841cd3658ba17f5c556134f33fe26ba56e0a02ab90babe5736d61390f736085ef8b9a9d994d9cbb685aa2bfb
-
Filesize
292KB
MD55bc38f3130148964d82a642b314c0811
SHA1b9755be3cb6de01745627c288253aeb680d307d6
SHA256a848bf1e584139446ba66896fe01aedf6726ce4e51bdb10b23afab53438c142a
SHA5120cbe3706a9a770aed43a3d5533a3ec183b236d14c4038c69490e719bfed2a835269727f7835256d711b3160bbc5f44d464efb20ab33750051ff26cd8319555bd