Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
27-04-2024 10:44
General
-
Target
2024-04-27_0fec6e7f658dabd5693071fdeba1bef0_magniber_revil.exe
-
Size
17.9MB
-
MD5
0fec6e7f658dabd5693071fdeba1bef0
-
SHA1
dcc3bd498c9fb998b71c060e98001d5c423fc720
-
SHA256
1f7cd9aa0b1ca7da749f176dd1e27bec59dccc7a47eca4a0234a96ffd59237bf
-
SHA512
b6c42e946bb73e2d504c2277da24194e020f4f8b7dfc8c010d7cd3b1f559e02cf02a1c53fd5cd6c99045d6f48ee8015c8edaeb09247d1c3e438ffeb084a3c07e
-
SSDEEP
196608:sGDZ9hB+JsVSeYmvvsqirsYmDwwzuhK+IAsrZOurqN+ElcA9ORd3MM:ZZ9vjVXPsqPtz3jdOurqNjG3
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for any installed AV software in registry 1 TTPs 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_0fec6e7f658dabd5693071fdeba1bef0_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_0fec6e7f658dabd5693071fdeba1bef0_magniber_revil.exe"1⤵
- Checks computer location settings
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.logFilesize
512KB
MD5b31cd2ca2794a1437ca21c9bb012941a
SHA12d794e9709382ae64535021e12f5c834d4e19f43
SHA2561998db078549422bd7e555da3cc31b674e4783506bf43a2cd8007b42463854c9
SHA51233951c860eafe2aa841224f845ac90fce7599c26c14966b9e8076b8881686c927f4d23b997fb355ebd853afaa4726bfc9ca062287c4d6881cd50a6a1db85b2fc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.datFilesize
14.0MB
MD56c441fdd907cc538e6dba93986e13056
SHA18211d44c94155d998314f8dbfb64329824a13eef
SHA256c5fd5a24e4ada3a963f3112ca8cce1a08a296e7bdabcea8e5cbeef9f12ee761d
SHA512cd79b795b574107d5b4cb36ea4db7b1f89c5442c20cb6f4ee9a4774bcc3edac44edbb7ace4df3ad84a7ebc84186f076a4e9dcc652be81da28ece27cf76616228
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfmFilesize
16KB
MD5918febb553a8bb9e6cb57f65b76e43d3
SHA1ed1770f3733943ac17e8f36707d9523c58a312cd
SHA256d09c3114d959088b7b5698616eb96226ee133717b62ce337a2763ac43afab28a
SHA51256fb17d17c4972d9de4a59b33037d8ccc72a72dcc995c4c6f4ab59df2047d51026abf2ff81d2c1118722e839e879ea28be599ca18b56d2ed7ffed1b370dc2a33
-
memory/3120-34-0x000000000AA00000-0x000000000AA08000-memory.dmpFilesize
32KB
-
memory/3120-37-0x000000000A790000-0x000000000A791000-memory.dmpFilesize
4KB
-
memory/3120-5-0x0000000004180000-0x0000000004181000-memory.dmpFilesize
4KB
-
memory/3120-6-0x0000000004190000-0x0000000004191000-memory.dmpFilesize
4KB
-
memory/3120-7-0x00000000041A0000-0x00000000041A1000-memory.dmpFilesize
4KB
-
memory/3120-10-0x0000000009810000-0x0000000009820000-memory.dmpFilesize
64KB
-
memory/3120-16-0x00000000099B0000-0x00000000099C0000-memory.dmpFilesize
64KB
-
memory/3120-0-0x0000000001B70000-0x0000000001B71000-memory.dmpFilesize
4KB
-
memory/3120-36-0x000000000A7A0000-0x000000000A7A8000-memory.dmpFilesize
32KB
-
memory/3120-4-0x0000000004170000-0x0000000004171000-memory.dmpFilesize
4KB
-
memory/3120-39-0x000000000A7A0000-0x000000000A7A8000-memory.dmpFilesize
32KB
-
memory/3120-42-0x000000000A790000-0x000000000A798000-memory.dmpFilesize
32KB
-
memory/3120-45-0x000000000A750000-0x000000000A751000-memory.dmpFilesize
4KB
-
memory/3120-3-0x0000000004160000-0x0000000004161000-memory.dmpFilesize
4KB
-
memory/3120-57-0x000000000A840000-0x000000000A848000-memory.dmpFilesize
32KB
-
memory/3120-59-0x000000000A880000-0x000000000A888000-memory.dmpFilesize
32KB
-
memory/3120-62-0x000000000A790000-0x000000000A791000-memory.dmpFilesize
4KB
-
memory/3120-66-0x000000000A750000-0x000000000A751000-memory.dmpFilesize
4KB
-
memory/3120-2-0x0000000004150000-0x0000000004151000-memory.dmpFilesize
4KB
-
memory/3120-1-0x0000000004140000-0x0000000004141000-memory.dmpFilesize
4KB