Overview

overview

7

Static

static

3

2024-04-04...il.exe

windows7-x64

7

2024-04-04...il.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-04-2024 20:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-04_f24c21fc028d0d04eed8eb65768a494d_magniber_revil.exe

  • Size

    13.3MB

  • MD5

    f24c21fc028d0d04eed8eb65768a494d

  • SHA1

    625f7073adc5b4faeafcc7639c0310d9a9907c7d

  • SHA256

    7d64f3c657193290b248aad982d194f68c917ddeb015227a3c02ac725166bb1f

  • SHA512

    db682cd8b8a6a0aea34cccb9095de5365b6a1f3374965627c05b1ab93d6684166d5c14cda0834635445e07ef6429ecfaef8494c6b5405019dbd39af30c32ee68

  • SSDEEP

    196608:56K8gKtEzcTsJjobFf1VS9C86JQtK5YzLhUBbBuUhT1z9yhwsns7G82C1:V8gKt/4joxf1x8KQtK4OBbBu/e882e

Score
7/10
bootkitpersistence

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-04_f24c21fc028d0d04eed8eb65768a494d_magniber_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-04_f24c21fc028d0d04eed8eb65768a494d_magniber_revil.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    PID:1600
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 1184
      2⤵
      • Program crash
      PID:2204
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1600 -ip 1600
    1⤵
      PID:4596

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\netul.dll
      Filesize

      1.9MB

      MD5

      47f5fe83659f9ea0c7b204a3e76f78b1

      SHA1

      cc1e2e5e7601473e69a28f4ab4a7ed29a07dbada

      SHA256

      e834072d776786c0a9336225b18a1b4da91f3fd056277af61ba97a203c8bbb5a

      SHA512

      18c50b839b40b5706da9b0b948ea7ea85718cd38cd463d44750fa608ac14a1b45eb498c5d73460f4b67c9d9677fc3227be0ca48024aaf2b76dcebd09900e5e64

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{3F6EC251-DB9D-4b7d-B82F-608993A3F505}.tmp\7z.dll
      Filesize

      1.1MB

      MD5

      7b265e9fd7556b3ce6e5c6e679c7212a

      SHA1

      bcbcdcd455d4a6fe39e0a91c4b8a7fb78b56230b

      SHA256

      f5961b7af060d06504cc99bed925fb450ce184962327225cb4ea9cad9a9922a9

      SHA512

      fa423bc6f03c33848dcbede961914fb4034c94544946f1b117a7bdcb5ca5075655b6d22d9385b8fe8b8eba7c59fce1d1024691472d26a64ab7286bc8760adf60

      Download Submit