Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
22-04-2024 03:29
General
-
Target
2024-04-22_5b81605235921d9c8d90130692bdf21e_magniber_revil.exe
-
Size
18.3MB
-
MD5
5b81605235921d9c8d90130692bdf21e
-
SHA1
f3fdefeb2a2d97f3181416b65b8d3a485389b72c
-
SHA256
c7fb240cdf01d946f633dfd8614471c9421b7d6148a5b7138ccda33c52508647
-
SHA512
75649bf132a08a2c616c794ffa7ad4b23dd10a4d144c446d3ece18ff6b2753d9f04d75c1a86e02631c31532dbb1d3b7a4e959f944e3d878f16d0358f9e2396bd
-
SSDEEP
196608:3GDZ9hB+JsVSeYmvvsqirsYmDwwzuhK+IAsrZ+urqN+ElcA9ORd3MZhqaq:CZ9vjVXPsqPtz3jd+urqNjG3Cqa
Malware Config
Signatures
-
Downloads MZ/PE file
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for any installed AV software in registry 1 TTPs 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_5b81605235921d9c8d90130692bdf21e_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_5b81605235921d9c8d90130692bdf21e_magniber_revil.exe"1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD59af5271e23d682077b5d542fe2b77979
SHA12a08b50ca0696f7130013be2771a3ec8aac4f2b7
SHA25629c79567497017d3eebcd10f2d2bc60433e334c1a10f2e4335554580bde6671d
SHA5125a1aa35f17cf49749df3a03b2df80504a92195dc8137cd1d3ad74f7249ff426d4a6e546e381a7aa5a1ca095f57273c39c9c576b2bc38474793d93d2a2f078013
-
Filesize
9KB
MD55d409f496c7c3a06488d5edf28938209
SHA17466a15013e27f9e65b706bb933cc414fbd12bb8
SHA25672e6797f0dcb60be197bff39fbe5457a4c7606d3a6cfa437c768efda4099355c
SHA51244476f187dbad5410ed494f9067e9b22b6b1a728101d219a119c1a2dae5fa37d3ad7d8585e6b11245a44bc57fac698b548f7b116ec50ab60b11710dd64352362
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB