magniber | 00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 17:29

Target
00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd.dll
Size 69KB
Sample261011-v21a1ax18l
SHA256 00270d016c00f9a58a8fad47aa52b95f2383e5b00a76e7281112156e828472bd
MD5 28f71f85417e8897ea1f27d8d9c16248
SHA1 c3f0881b1e543ac8a9172e0528ac1400820622dd
SHA512 7bebacbcfd25325cc9af2be0727e926f57564c437e0a03c63e188bee900c1d3370206e62cdb86d7634f79d8b2678235d36796c000c4e879a70f173b68f4ce988
SSDEEP 1536:OtBd0whwlxq3REfnynG2JrkDUgjsqyzMIN8jcahCc4ySyI:O2wJevwuyzF3ZyXI
TLSH
T1F963C274C389C019EAD7BA3552C9FE7B4745B922E787175B0824B2983E3B6F2CC81352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Detect magniber ransomware 2 IoCs

resource	yara_rule
behavioral2/memory/4348-1-0x0000018E83F70000-0x0000018E83F7D000-memory.dmp	family_magniber
behavioral2/memory/2336-2-0x0000013AAF930000-0x0000013AAF93B000-memory.dmp	family_magniber

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4348	rundll32.exe
4348	rundll32.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 2336	4348	rundll32.exe	44
PID 4348 wrote to memory of 3148	4348	rundll32.exe	47
PID 4348 wrote to memory of 3420	4348	rundll32.exe	49
PID 4348 wrote to memory of 4092	4348	rundll32.exe	56
PID 4348 wrote to memory of 4312	4348	rundll32.exe	58
PID 4348 wrote to memory of 4380	4348	rundll32.exe	59
PID 4348 wrote to memory of 4440	4348	rundll32.exe	60
PID 4348 wrote to memory of 4716	4348	rundll32.exe	62
PID 4348 wrote to memory of 4908	4348	rundll32.exe	63
PID 4348 wrote to memory of 1176	4348	rundll32.exe	64
PID 4348 wrote to memory of 5208	4348	rundll32.exe	65
PID 4348 wrote to memory of 4688	4348	rundll32.exe	77
PID 4348 wrote to memory of 1604	4348	rundll32.exe	79
PID 4348 wrote to memory of 5232	4348	rundll32.exe	80
PID 4348 wrote to memory of 5676	4348	rundll32.exe	81
PID 4348 wrote to memory of 5184	4348	rundll32.exe	82

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3148

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:4092

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4312

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4440

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4716

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000268;000000000000026C;
1⤵
PID:4908

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:1176

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5208

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:4688

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:5676

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5184

memory/2336-2-0x0000013AAF930000-0x0000013AAF93B000-memory.dmp

Download

memory/4348-1-0x0000018E83F70000-0x0000018E83F7D000-memory.dmp

Download

memory/4348-0-0x00007FFF4A730000-0x00007FFF4A741000-memory.dmp

Download