Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
22-04-2024 03:29
General
-
Target
2024-04-22_5b81605235921d9c8d90130692bdf21e_magniber_revil.exe
-
Size
18.3MB
-
MD5
5b81605235921d9c8d90130692bdf21e
-
SHA1
f3fdefeb2a2d97f3181416b65b8d3a485389b72c
-
SHA256
c7fb240cdf01d946f633dfd8614471c9421b7d6148a5b7138ccda33c52508647
-
SHA512
75649bf132a08a2c616c794ffa7ad4b23dd10a4d144c446d3ece18ff6b2753d9f04d75c1a86e02631c31532dbb1d3b7a4e959f944e3d878f16d0358f9e2396bd
-
SSDEEP
196608:3GDZ9hB+JsVSeYmvvsqirsYmDwwzuhK+IAsrZ+urqN+ElcA9ORd3MZhqaq:CZ9vjVXPsqPtz3jd+urqNjG3Cqa
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for any installed AV software in registry 1 TTPs 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_5b81605235921d9c8d90130692bdf21e_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_5b81605235921d9c8d90130692bdf21e_magniber_revil.exe"1⤵
- Checks computer location settings
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 32562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 940 -ip 9401⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5a1ba5ce44d838226acba27ff2799f905
SHA14951d2095fc037fd81a24e3296e82ec8a827a3aa
SHA25629317ca2e90ce8590f830a5b9366d2a481bad161e7e2d921fc0c2108fbccd286
SHA512744c5064b8dbad3b1633830c11d1376ce7ad309cc27fda1434b51f1892c0ce4ca673210eb42bb0f58e2193698047c72df1ab327e88b8adaf48bd35e94bb8c8d9
-
Filesize
14.0MB
MD50d27edb021a5c1e7ac2b8d23d401f487
SHA191e4a62e695479d25339c35bfabdb9a01c848578
SHA256e171e150da426e71b89fbe9f1a95c2bd6655f69313c31d7e9b91f9a533aedb12
SHA512c1564a7d3238cefee2d9817b4d21f4ec88153b687c8e62d4f93a5706146de44d0e1854941779d2e8639e3f07f3082c12d50460a2aa26f3c7974f0505924c72bb
-
Filesize
16KB
MD581c10d20824eaf277e99f6952d2b8362
SHA103c9899749a59d393ffb297e095859148f4d9fd7
SHA2561863178190d0eb0e5aa5584e4e680023c016ea4931fcd1e4032936af1903714c
SHA512812037dc93a264da7b72e7f934121e8bc4a6997a8e10086b4d22f893c5cd7b8dbb1bc87d2ac4c8bc7e61e6fd04d5f48e945e8314dd4533d2090ac65bc844ae86
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB