Analysis
- max time kernel
122s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 07:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe
- Size 381KB
- Sample260825-h1eaxstybz
- SHA256 8fb135c771e210f51b6019abe0ef46024168634782780ca80fa800b2e9f361a0
- MD5 95602afdffbdbbce12e978745c5d28be
- SHA1 e43547731604e2f5dc14f01800382e25567299e3
- SHA512 b1df264d5c2156b9aaecf3bf77a0522dca597d2cf0ec8248d1326f27671fefab61bdb21bdda86fc003bc98e2b4e2343e7a955726be9c679da3443e800eca3719
- SSDEEP 6144:s4QbpPoYHc/IYfa5O4MheHBMENBKaYd1iwRz:LGwYAbarEeHBM8BKaxez
- TLSH T1DE849D1134B5E434F8BB92B24565DE0315BDBEA28BB28EDF37EC568906764D0A333352
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 41 IoCs
resource yara_rule behavioral2/memory/5844-1-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-6-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-3-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-4-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-8-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-7-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-5-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-14-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-18-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-15-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-9-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-21-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-22-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-23-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-24-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-26-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-25-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-29-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-30-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-31-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-34-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-35-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-38-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-40-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-43-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-47-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-49-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-50-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-52-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-53-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-54-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-56-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-58-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-60-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-62-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-64-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-66-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-68-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-70-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-74-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5844-75-0x0000000003070000-0x000000000412A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 43 IoCs
resource yara_rule behavioral2/memory/5844-1-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-6-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-3-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-4-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-8-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-7-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-5-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-14-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-18-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-15-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-9-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-21-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-22-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-23-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-24-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-26-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-25-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-29-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-30-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-31-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-34-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-35-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-38-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-40-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-43-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-47-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-49-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-50-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-52-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-53-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-54-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-56-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-58-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-60-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-62-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-64-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-66-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-68-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-70-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-74-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-75-0x0000000003070000-0x000000000412A000-memory.dmp UPX behavioral2/memory/5844-108-0x0000000003000000-0x000000000306B000-memory.dmp UPX behavioral2/memory/5636-127-0x0000000003000000-0x000000000306B000-memory.dmp UPX - Executes dropped EXE 2 IoCs
pid Process 5636 winmgr.exe 5788 winmgr.exe - Windows security modification 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50507407672498529407607204597224050\\winmgr.exe" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Windows\\M-50507407672498529407607204597224050\\winmgr.exe" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\X: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\L: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\M: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\O: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\Q: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\D: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\R: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\V: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\W: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\N: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\P: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\U: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\Y: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\Z: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\G: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\H: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\I: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\J: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\K: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened (read-only) \??\S: 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification F:\autorun.inf 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 5844 set thread context of 3476 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 88 PID 5636 set thread context of 5788 5636 winmgr.exe 92 -
resource yara_rule behavioral2/memory/5844-1-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-6-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-3-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-4-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-8-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-7-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-5-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-14-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-18-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-15-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-9-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-21-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-22-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-23-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-24-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-26-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-25-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-29-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-30-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-31-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-34-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-35-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-38-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-40-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-43-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-47-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-49-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-50-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-52-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-53-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-54-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-56-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-58-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-60-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-62-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-64-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-66-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-68-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-70-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-74-0x0000000003070000-0x000000000412A000-memory.dmp upx behavioral2/memory/5844-75-0x0000000003070000-0x000000000412A000-memory.dmp upx - Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe winmgr.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe winmgr.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe - Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\M-50507407672498529407607204597224050\winmgr.exe 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification C:\Windows\M-50507407672498529407607204597224050 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification C:\Windows\M-50507407672498529407607204597224050\winmgr.exe 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification C:\Windows\M-50507407672498529407607204597224050\winmgr.exe 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File created C:\Windows\e59f4c6 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe File opened for modification C:\Windows\SYSTEM.INI 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6056 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe Token: SeDebugPrivilege 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5844 wrote to memory of 1192 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 15 PID 5844 wrote to memory of 3104 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 45 PID 5844 wrote to memory of 3216 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 47 PID 5844 wrote to memory of 3492 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 48 PID 5844 wrote to memory of 3324 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 55 PID 5844 wrote to memory of 4396 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 57 PID 5844 wrote to memory of 4432 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 58 PID 5844 wrote to memory of 4476 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 59 PID 5844 wrote to memory of 4716 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 60 PID 5844 wrote to memory of 5064 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 62 PID 5844 wrote to memory of 2776 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 63 PID 5844 wrote to memory of 5132 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 64 PID 5844 wrote to memory of 5168 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 65 PID 5844 wrote to memory of 1356 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 78 PID 5844 wrote to memory of 6000 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 80 PID 5844 wrote to memory of 5924 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 81 PID 5844 wrote to memory of 4548 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 82 PID 5844 wrote to memory of 1192 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 15 PID 5844 wrote to memory of 3104 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 45 PID 5844 wrote to memory of 3216 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 47 PID 5844 wrote to memory of 3492 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 48 PID 5844 wrote to memory of 3324 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 55 PID 5844 wrote to memory of 4396 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 57 PID 5844 wrote to memory of 4432 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 58 PID 5844 wrote to memory of 4476 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 59 PID 5844 wrote to memory of 4716 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 60 PID 5844 wrote to memory of 5064 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 62 PID 5844 wrote to memory of 2776 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 63 PID 5844 wrote to memory of 5132 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 64 PID 5844 wrote to memory of 5168 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 65 PID 5844 wrote to memory of 1356 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 78 PID 5844 wrote to memory of 6000 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 80 PID 5844 wrote to memory of 5924 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 81 PID 5844 wrote to memory of 4548 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 82 PID 5844 wrote to memory of 1192 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 15 PID 5844 wrote to memory of 3104 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 45 PID 5844 wrote to memory of 3216 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 47 PID 5844 wrote to memory of 3492 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 48 PID 5844 wrote to memory of 3324 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 55 PID 5844 wrote to memory of 4396 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 57 PID 5844 wrote to memory of 4432 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 58 PID 5844 wrote to memory of 4476 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 59 PID 5844 wrote to memory of 4716 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 60 PID 5844 wrote to memory of 5064 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 62 PID 5844 wrote to memory of 2776 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 63 PID 5844 wrote to memory of 5132 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 64 PID 5844 wrote to memory of 5168 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 65 PID 5844 wrote to memory of 1356 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 78 PID 5844 wrote to memory of 6000 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 80 PID 5844 wrote to memory of 5924 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 81 PID 5844 wrote to memory of 4548 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 82 PID 5844 wrote to memory of 1192 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 15 PID 5844 wrote to memory of 3104 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 45 PID 5844 wrote to memory of 3216 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 47 PID 5844 wrote to memory of 3492 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 48 PID 5844 wrote to memory of 3324 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 55 PID 5844 wrote to memory of 4396 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 57 PID 5844 wrote to memory of 4432 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 58 PID 5844 wrote to memory of 4476 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 59 PID 5844 wrote to memory of 4716 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 60 PID 5844 wrote to memory of 5064 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 62 PID 5844 wrote to memory of 2776 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 63 PID 5844 wrote to memory of 5132 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 64 PID 5844 wrote to memory of 5168 5844 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe 65 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1192
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3104
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3216
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3492
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3324
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4396
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4476
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4716
-
C:\Windows\system32\ctfmon.exe/QuitInfo:000000000000026C;0000000000000270;1⤵PID:5064
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:2776
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:5132
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5168
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1356
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_95602afdffbdbbce12e978745c5d28be_elex_magniber.exe"4⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vjncmrrild.bat" "5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6056 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:5044
-
-
-
C:\Windows\M-50507407672498529407607204597224050\winmgr.exeC:\Windows\M-50507407672498529407607204597224050\winmgr.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5636 -
C:\Windows\M-50507407672498529407607204597224050\winmgr.exeC:\Windows\M-50507407672498529407607204597224050\winmgr.exe6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5788
-
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5924
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:4548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:8
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\edakubnfgu
- Size 383KB
- SHA256 e345eff5cb8cf6d92c55e6998bb275c3b5c11b7f3dc7734f003728ddbe5d1b80
- MD5 1a7302805f49873854135e4771414e27
- SHA1 e2d73800dc0d24d96cf58327decb6217b734bf62
- SHA512 a687eb75a545c99b9cdfb4368f8e283891da8ead721cd91cba3fa23086b38827ce38a69d0098566ac0af4955b5d564ebccc4c7194a6d5ece13108c0594b3f0dc
- SSDEEP 6144:s4QbpPoYHc/IYfa5O4MheHBMENBKaYd1iwR/:LGwYAbarEeHBM8BKaxe/
- TLSH T1B0849D1174B5E434F8BB92B24565DE0315BDBEA28BB28EDF37EC168906764D0A333352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vjncmrrild.bat
- Size 288B
- SHA256 db15abb935b8454d641b59c2882146d49619c700dc6247e000f2bca71033a29d
- MD5 6e0f97704c6f4c31124aaeb91fcf4b2f
- SHA1 a35e9aa04b85f3b6c83d7a82b95c8c12bd5a11a7
- SHA512 51dcc957f213d63f5ee0ea7299ea599b84465d3e69c0b45d141650039d5fe04440160b3a3b7af77d8ab797dbf0ad513a503c9f6116dad6982404b91ed0facb98
- TLSH T1E7D0C2A241EFDD1E1C88619B8BE592CCC078BA5DAE8C3F197290CC4860C288CF8C6342
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\M-50507407672498529407607204597224050\winmgr.exe
- Size 381KB
- SHA256 8fb135c771e210f51b6019abe0ef46024168634782780ca80fa800b2e9f361a0
- MD5 95602afdffbdbbce12e978745c5d28be
- SHA1 e43547731604e2f5dc14f01800382e25567299e3
- SHA512 b1df264d5c2156b9aaecf3bf77a0522dca597d2cf0ec8248d1326f27671fefab61bdb21bdda86fc003bc98e2b4e2343e7a955726be9c679da3443e800eca3719
- SSDEEP 6144:s4QbpPoYHc/IYfa5O4MheHBMENBKaYd1iwRz:LGwYAbarEeHBM8BKaxez
- TLSH T1DE849D1134B5E434F8BB92B24565DE0315BDBEA28BB28EDF37EC568906764D0A333352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\jyqu.exe
- Size 97KB
- SHA256 fa077bcf8108a33282d9f889c5b52efe71a978db41f5f714bfeb3e779bd0e88c
- MD5 b366745a763d4ae6a8ca2d9f51ae7a56
- SHA1 e3e37ed5294adc68a38df2f0d1beeb9edc4339d0
- SHA512 41fbe3cd99bb39095b41c6de79b0b1e318164dc1f91f5b3112de134d6a4d7b05f4dbc54d7ac1750c18cf4fd4464bb5e8390e8c228825fdce733cbea90a81c777
- SSDEEP 1536:iAYW3MiCytn7W/V6pOJoQ/9uAiPHgGfHM+FfKgoEVLq8M2eckQ4EuEfC56RvAVcr:iAwiC2HpOJoS9mAvmhlM+RhfCKmcko
- TLSH T166A3025717C0DE9ED0E99CF0E18D5B85C38E715135726B902F48BF26F042C68A2B6BD6
- MD5 SHA1 SHA512 SSDEEP TLSH