Analysis
-
max time kernel
124s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
30-06-2024 15:53
General
-
Target
2024-06-30_a929042a85c0ebe291a1b2b55f948567_magniber.exe
-
Size
2.9MB
-
MD5
a929042a85c0ebe291a1b2b55f948567
-
SHA1
1211f45dc01988f0ba2f63b13e197af6e27603be
-
SHA256
e77d8392c09e6c1a42337f0079967c879bbf933358436a38791e4014f3ebfd7b
-
SHA512
1e9d36cb684d9d4b6be8efb02a30bf020d3661b6718ab3bcfbb62d9a2c0cedc9d37197443aad00a7a6db340a6cdebe268f1b5341282777ee2a2790d0f1417a2a
-
SSDEEP
49152:VpAJ4K/kZCRW6JIAYtBRVXJT8IE+eDvkX6uPh0OR8/dJ388mS5vbv+fH2rJnLs5V:gdkyIAYt3VXNeTkquPhO881Vv5LndS
Score
10/10
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 38 IoCs
-
UPX dump on OEP (original entry point) 38 IoCs
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 12 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-06-30_a929042a85c0ebe291a1b2b55f948567_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-30_a929042a85c0ebe291a1b2b55f948567_magniber.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\ctcm.exeFilesize
97KB
MD58f948bc0137a1bd1c815550872e08f49
SHA1b774c84d0c237b27563658238568879118a47149
SHA256376b59faea9bfa6323d37a6b54b1f3cbb396d3c04f819b25abd684759632f12c
SHA512139b641771a427c20032e17b37434d8ebc674b7ae0feee0ed47e18c1e69cb0751cc1451e980f0e0275ad29c1c40cee40703c243f76a4ac39b32e5f72ec0438f4
-
memory/4128-29-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-17-0x0000000004440000-0x0000000004442000-memory.dmpFilesize
8KB
-
memory/4128-5-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-1-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-18-0x0000000004440000-0x0000000004442000-memory.dmpFilesize
8KB
-
memory/4128-14-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-13-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-20-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-19-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-6-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-28-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-15-0x0000000004440000-0x0000000004442000-memory.dmpFilesize
8KB
-
memory/4128-31-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-3-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-22-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-21-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-23-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-24-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-25-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-27-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-16-0x0000000004590000-0x0000000004591000-memory.dmpFilesize
4KB
-
memory/4128-4-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-12-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-32-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-34-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-36-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-39-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-41-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-44-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-46-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-47-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-50-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-52-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-53-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-55-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-57-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-64-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-66-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-68-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-70-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-71-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-73-0x0000000004440000-0x0000000004442000-memory.dmpFilesize
8KB
-
memory/4128-76-0x0000000002600000-0x00000000036BA000-memory.dmpFilesize
16.7MB
-
memory/4128-0-0x0000000000400000-0x0000000000711000-memory.dmpFilesize
3.1MB