magniber | 00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd.dll
Size 69KB
Sample261011-v21a1ax18l
SHA256 00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd
MD5 28f71f85417e8897ea1f27d8d9c16248
SHA1 c3f0881b1e543ac8a9172e0528ac1400820622dd
SHA512 7bebacbcfd25325cc9af2be0727e926f57564c437e0a03c63e188bee900c1d3370206e62cdb86d7634f79d8b2678235d36796c000c4e879a70f173b68f4ce988
SSDEEP 1536:OtBd0whwlxq3REfnynG2JrkDUgjsqyzMIN8jcahCc4ySyI:O2wJevwuyzF3ZyXI
TLSH
T1F963C274C389C019EAD7BA3552C9FE7B4745B922E787175B0824B2983E3B6F2CC81352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion magniber privilege_escalation ransomware

Malware Config

Signatures

Family: Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Detect magniber ransomware 2 IoCs

resource	yara_rule
behavioral1/memory/1724-1-0x0000024539680000-0x000002453968D000-memory.dmp	family_magniber
behavioral1/memory/2616-2-0x000002E0D2260000-0x000002E0D226B000-memory.dmp	family_magniber

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process
PID 1724 set thread context of 0	1724	rundll32.exe
PID 1724 set thread context of 0	1724	rundll32.exe
PID 1724 set thread context of 0	1724	rundll32.exe
PID 1724 set thread context of 0	1724	rundll32.exe
PID 1724 set thread context of 0	1724	rundll32.exe
PID 1724 set thread context of 0	1724	rundll32.exe
PID 1724 set thread context of 0	1724	rundll32.exe
PID 1724 set thread context of 0	1724	rundll32.exe
PID 1724 set thread context of 0	1724	rundll32.exe
PID 1724 set thread context of 0	1724	rundll32.exe
PID 1724 set thread context of 0	1724	rundll32.exe
PID 1724 set thread context of 0	1724	rundll32.exe
PID 1724 set thread context of 0	1724	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	rundll32.exe
1724	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3292	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE
Token: SeShutdownPrivilege	3760	RuntimeBroker.exe
Token: SeShutdownPrivilege	3760	RuntimeBroker.exe
Token: SeShutdownPrivilege	3760	RuntimeBroker.exe
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE
Token: SeShutdownPrivilege	3760	RuntimeBroker.exe
Token: SeShutdownPrivilege	3760	RuntimeBroker.exe
Token: SeShutdownPrivilege	3760	RuntimeBroker.exe
Token: SeShutdownPrivilege	3292	Explorer.EXE
Token: SeCreatePagefilePrivilege	3292	Explorer.EXE

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
3292	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2616	1724	rundll32.exe	51
PID 1724 wrote to memory of 2924	1724	rundll32.exe	52
PID 1724 wrote to memory of 2996	1724	rundll32.exe	53
PID 1724 wrote to memory of 3292	1724	rundll32.exe	56
PID 1724 wrote to memory of 3408	1724	rundll32.exe	57
PID 1724 wrote to memory of 3596	1724	rundll32.exe	58
PID 1724 wrote to memory of 3692	1724	rundll32.exe	59
PID 1724 wrote to memory of 3760	1724	rundll32.exe	60
PID 1724 wrote to memory of 3840	1724	rundll32.exe	61
PID 1724 wrote to memory of 4020	1724	rundll32.exe	62
PID 1724 wrote to memory of 4704	1724	rundll32.exe	65
PID 1724 wrote to memory of 5068	1724	rundll32.exe	75

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2924

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2996

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3292
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3408

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3596

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3692

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3840

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4020

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4704

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:5068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Process Hollowing

T1055.012

Defense Evasion

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-0-0x00007FFB036A0000-0x00007FFB036B1000-memory.dmp

Download

memory/1724-1-0x0000024539680000-0x000002453968D000-memory.dmp

Download

memory/2616-2-0x000002E0D2260000-0x000002E0D226B000-memory.dmp

Download

memory/3596-16-0x0000023A5BE20000-0x0000023A5BE28000-memory.dmp

Download

memory/3596-17-0x0000023A5BD50000-0x0000023A5BD51000-memory.dmp

Download