Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/05/2024, 14:32
Behavioral task
behavioral1
Sample
2024-05-11_e4cfef88f34f47be8c4c0b8ccc0faa2d_magniber_revil.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-11_e4cfef88f34f47be8c4c0b8ccc0faa2d_magniber_revil.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-05-11_e4cfef88f34f47be8c4c0b8ccc0faa2d_magniber_revil.exe
- Size 13.6MB
- Sample240511-rv83saef45
- SHA256 fccedd884be4b0e132cc422fbfe7e21adb41cd52305c70f1f020ed0d17abb4f5
- MD5 e4cfef88f34f47be8c4c0b8ccc0faa2d
- SHA1 0c2fdbcac749f3d052be6561a7bb676818c94fbb
- SHA512 083fbc9e2fdd5e6c19dcb68daa68351747793793d911826edba148c8c9fefeb02ad2501874ca3b938ad2d9a0432609dfe7f719e4a90a27e9c9ded7e39d3ce46b
- SSDEEP 393216:JjwDaujhWGVrqNQZdQ3/YdcBoMIB+6J0ZucBoMIB+rJwLZ:a2ujdbQ3kcBoMIB+6hcBoMIB+r6
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- Executes dropped EXE 1 IoCs
pid Process 2592 af048ca4-415d-4800-9e1b-bb49328e9f26.exe - Loads dropped DLL 3 IoCs
pid Process 988 regsvr32.exe 1564 DllHost.exe 2592 af048ca4-415d-4800-9e1b-bb49328e9f26.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBCFF0EC-064C-4C21-B488-823B838CEDE5}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F760F90-72E0-4410-A71E-21266952AC79} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B2D97AAF-FD1E-4C86-A61A-3B5ECD04A9BD} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{889D5738-5CBE-48FC-B26E-06B5E65E401C}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6981F001-A7F7-4444-9B0C-EE8B8D44C6A6}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A015E73-65B0-4F17-BABD-0818B134E3D5}\ = "IGeoIP" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521D72FD-27AA-4C70-BD6F-03D3FB8BC413} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F859FDA6-7EFF-4452-9DA5-D4D4A6C62DCA}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4CBF477E-EC72-452D-A8CC-41A1F7F49E25}\TypeLib\ = "{20CE383E-60AF-43C9-A141-FFE5E11885D0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F760F90-72E0-4410-A71E-21266952AC79}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6981F001-A7F7-4444-9B0C-EE8B8D44C6A6}\TypeLib\ = "{DD136A0B-F50C-4BB6-AC16-BBE425C7B72B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC1E983A-E832-47CA-83C0-D525B926D485}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9AE3114-9335-4D0E-8A53-6D3624571343} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F760F90-72E0-4410-A71E-21266952AC79}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55822341-7F3E-46AE-9CF3-763AE96C2F74}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E688212-E740-4CE4-BE7E-DB3F2A3FB5AB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06DA7C37-2C7A-44DF-BC78-AE5D77AB5AAB}\ = "IStatist" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6981F001-A7F7-4444-9B0C-EE8B8D44C6A6}\ = "IDownloadItemExternalApp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{889D5738-5CBE-48FC-B26E-06B5E65E401C}\TypeLib\ = "{DD136A0B-F50C-4BB6-AC16-BBE425C7B72B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B721818A-6577-47C4-A128-4218797801EE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C3615C89-B242-4002-BAF2-E5441EF4B62F}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0010390D-7A0A-4694-A058-E7291D854660}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B721818A-6577-47C4-A128-4218797801EE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B721818A-6577-47C4-A128-4218797801EE}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6981F001-A7F7-4444-9B0C-EE8B8D44C6A6}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2DABE907-DB29-49CC-A614-67C0B35288D5}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F49AC5B-8B1F-4404-B68E-3990F2C3B4C3}\TypeLib\ = "{DD136A0B-F50C-4BB6-AC16-BBE425C7B72B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{97CD84AD-0133-4D99-A832-73C3205D51ED}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13DF48DD-0CE7-4ECE-B556-007DF36E0769}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F859FDA6-7EFF-4452-9DA5-D4D4A6C62DCA}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55CD60BC-9200-4879-91A9-68FEB0694215}\ = "IDownloadItemModule3_1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C255D30A-CEDC-4EA0-A82A-93BE46AC4EB5} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6D76C65-E5DD-480B-9AD2-B1587676AC17} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F49AC5B-8B1F-4404-B68E-3990F2C3B4C3}\ = "IToolbarStart" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4917E3C0-8161-4CD2-BFF4-2764A4E8021D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2096C7B-4CD1-4A59-B555-94CD41D52764}\ = "ISaveUserDataStruct" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55822341-7F3E-46AE-9CF3-763AE96C2F74}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6D76C65-E5DD-480B-9AD2-B1587676AC17}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03AB6594-C405-4486-BD9C-120C0690BC0E}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71550962-34BF-4724-BEC7-8BE269187602} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C97D1E4B-D8A8-4E01-AC3F-A676591A397D}\TypeLib\ = "{20CE383E-60AF-43C9-A141-FFE5E11885D0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC1E983A-E832-47CA-83C0-D525B926D485} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{889D5738-5CBE-48FC-B26E-06B5E65E401C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC1E983A-E832-47CA-83C0-D525B926D485}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06DA7C37-2C7A-44DF-BC78-AE5D77AB5AAB}\TypeLib\ = "{DD136A0B-F50C-4BB6-AC16-BBE425C7B72B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{889D5738-5CBE-48FC-B26E-06B5E65E401C}\ = "IInstallItemToolbar" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2A015E73-65B0-4F17-BABD-0818B134E3D5}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BE859260-23C8-4751-B0F6-59FD78CE435C}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{97CD84AD-0133-4D99-A832-73C3205D51ED}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13DF48DD-0CE7-4ECE-B556-007DF36E0769}\ = "DownloadItemModule Class" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBCFF0EC-064C-4C21-B488-823B838CEDE5}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F4DC035-BEA7-4D57-92B6-BF17F09E7D3E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B721818A-6577-47C4-A128-4218797801EE}\ = "IInstallItemsList" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21718F2D-26E1-4B34-972B-61C13369EE51}\AppID = "{570EEAE9-654E-4392-9781-7FBB8B54C2FD}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71550962-34BF-4724-BEC7-8BE269187602}\ = "GeoIP Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2096C7B-4CD1-4A59-B555-94CD41D52764}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B721818A-6577-47C4-A128-4218797801EE}\ = "IInstallItemsList" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06DA7C37-2C7A-44DF-BC78-AE5D77AB5AAB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F4DC035-BEA7-4D57-92B6-BF17F09E7D3E}\TypeLib\Version = "1.0" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521D72FD-27AA-4C70-BD6F-03D3FB8BC413}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{97CD84AD-0133-4D99-A832-73C3205D51ED}\InprocServer32\ = "C:\\ProgramData\\Soda PDF Desktop 11\\Installation\\Statistics.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBCFF0EC-064C-4C21-B488-823B838CEDE5}\TypeLib\ = "{969DE2F9-AF2F-4F0C-A050-2C5938C28AD3}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBCFF0EC-064C-4C21-B488-823B838CEDE5}\AppID = "{570EEAE9-654E-4392-9781-7FBB8B54C2FD}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C97D1E4B-D8A8-4E01-AC3F-A676591A397D}\Version regsvr32.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd942000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 af048ca4-415d-4800-9e1b-bb49328e9f26.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 af048ca4-415d-4800-9e1b-bb49328e9f26.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a af048ca4-415d-4800-9e1b-bb49328e9f26.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a af048ca4-415d-4800-9e1b-bb49328e9f26.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 af048ca4-415d-4800-9e1b-bb49328e9f26.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d42000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6 af048ca4-415d-4800-9e1b-bb49328e9f26.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4088 wrote to memory of 2592 4088 2024-05-11_e4cfef88f34f47be8c4c0b8ccc0faa2d_magniber_revil.exe 87 PID 4088 wrote to memory of 2592 4088 2024-05-11_e4cfef88f34f47be8c4c0b8ccc0faa2d_magniber_revil.exe 87 PID 4088 wrote to memory of 2592 4088 2024-05-11_e4cfef88f34f47be8c4c0b8ccc0faa2d_magniber_revil.exe 87 PID 2592 wrote to memory of 988 2592 af048ca4-415d-4800-9e1b-bb49328e9f26.exe 89 PID 2592 wrote to memory of 988 2592 af048ca4-415d-4800-9e1b-bb49328e9f26.exe 89 PID 2592 wrote to memory of 988 2592 af048ca4-415d-4800-9e1b-bb49328e9f26.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_e4cfef88f34f47be8c4c0b8ccc0faa2d_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_e4cfef88f34f47be8c4c0b8ccc0faa2d_magniber_revil.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\af048ca4-415d-4800-9e1b-bb49328e9f26.exeC:\Users\Admin\AppData\Local\Temp\af048ca4-415d-4800-9e1b-bb49328e9f26.exe /update=start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\ProgramData\Soda PDF Desktop 11\Installation\Statistics.dll"3⤵
- Loads dropped DLL
- Modifies registry class
PID:988
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{570EEAE9-654E-4392-9781-7FBB8B54C2FD}1⤵
- Loads dropped DLL
PID:1564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Soda PDF Desktop 11\Installation\Statistics.dll
- Size 1.9MB
- SHA256 019b540c329bb7be89423c2db9692c45c394eb8a0760ac73fac276978340df1d
- MD5 c2ad4a2aa80c09ae7f976ec3a9354c03
- SHA1 6f76da3a1677c202e374f0fbf3b2630c4fc6880f
- SHA512 641163ebc40123fe7b6ef8f9e07a7c2be2f7284bddc6e75e0c1cbc8b5bc2b04adb084958c0197effa83e5a0ec83d8627091ecdc2b373ee95ce281215c00f3426
- SSDEEP 49152:E10sptnzM3OyJH9rvx8p39bTbjmkRo1j7r2vMf9t:zgzI5H9rvxO3QIo8m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Soda PDF Desktop 11\Installation\common-data.dat
- Size 1KB
- SHA256 7ed89705ebeee833f48a867352863e0c50e8a5e5c50b1a9d12098d57c0e804de
- MD5 d3649d344d5c26b03afbb1b1de6e494e
- SHA1 2f257c56cdebe81a87c4da1f347e5c78e17416e9
- SHA512 ad0a23ab817d8ef92e68e2daea81a58e9757850c8daf6023c3c437991c44a22387b337f6e4674e249e33c1c677aeaded66efdf42ded62b92ef3ef6a15cb179eb
- MD5 SHA1 SHA512
- Path C:\ProgramData\Soda PDF Desktop 11\Installation\common-data.dat
- Size 746B
- SHA256 4831ef6773f4dcbd68dd5db8f4f8eb00fe8f1cffe391d652448db2648e0974de
- MD5 70242e2cbe9be33bb4e2b3838a25124c
- SHA1 4c79a7ab9857893baca86ab643206ebac02901ac
- SHA512 c174ff6c69e38c3c732b239967b86d9dc54ef0385fed4de7d812f3f8291644b4232e026e06e462df20059f6ca620766fcc9e8a2f942ddf1dc69680e28a99e35f
- MD5 SHA1 SHA512
- Path C:\ProgramData\Soda PDF Desktop 11\Installation\curl-ca-bundle.crt
- Size 213KB
- SHA256 20c8dd6dd4665d46dc304302b48964ac617c56d88ef55ef8078d0bdf94bccf34
- MD5 d37f51f99f2b105be112766c030b9120
- SHA1 ced10635f3b6a0fe3afd0b96ba4dbb4cb0a3c795
- SHA512 65f6e695409b87fe69467909b924945709323a569ebb367da19209e9c920777a6e32936fda03ffe5cf3693a22069680e7974f308fce6fab6649312ce3ccc73fc
- SSDEEP 3072:+flGUhzIjom0Utnwo6J7gZ7IvqT3x9BYv0yvAvVT/mRR283rz9KKbWqI+CyrGj4w:f6m0Gwo+kZbqcBdbgF8+yaU5Namc5iSq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
- Size 1KB
- SHA256 c4f6569e2a98b4523a8a772c1d55461e9e3415712bb423e9d8ba1b70ac509aa2
- MD5 57b1b5453fd21a15ec32fee93515efbe
- SHA1 71b7fea3000a04bee4b875834101cc64ddccc72b
- SHA512 4eee10ed4dc800964073ac65d2569e1713a0d0539ac275ff511c06bdcca63f2b2c8cf59961bdf63406277931360f39657526d56e453f5b097b897882e2a2e8cc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
- Size 724B
- SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
- MD5 8202a1cd02e7d69597995cabbe881a12
- SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
- SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
- Size 410B
- SHA256 0331190df31c7dd5143e5f8f9a1f02eb6091a64163f65fea79f199ac3256c781
- MD5 436e1b9a0ca61075c9e3f7112e0f862d
- SHA1 311779d8387266320eb9711712bc93023f90c06d
- SHA512 886d10478618e212a42794e4f6b95d978a86b5f5f8973bdbe2248a555ac7695549d72d5c9c46d66305700fe44eaab4d804f92232a5b6310ccfa8e7cc29b1324c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
- Size 392B
- SHA256 5db53ab7304f57458dfd1fe0db3c571bea91d98ccc300725f947e8836132c5ae
- MD5 1abc571bfe953fdb322b1d3d7f125354
- SHA1 cf61f03fe2384e414e1cdcb5e747b76dccd68b0c
- SHA512 2a4b5156b1b88ba35387d1ec55783acca4772d4385601fa3ef08e966d882885135d3b89194b1dfec2ca9a281ea72422215a428ccf2038cbd8807581e2ee553a3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\af048ca4-415d-4800-9e1b-bb49328e9f26.exe
- Size 13.6MB
- SHA256 fccedd884be4b0e132cc422fbfe7e21adb41cd52305c70f1f020ed0d17abb4f5
- MD5 e4cfef88f34f47be8c4c0b8ccc0faa2d
- SHA1 0c2fdbcac749f3d052be6561a7bb676818c94fbb
- SHA512 083fbc9e2fdd5e6c19dcb68daa68351747793793d911826edba148c8c9fefeb02ad2501874ca3b938ad2d9a0432609dfe7f719e4a90a27e9c9ded7e39d3ce46b
- SSDEEP 393216:JjwDaujhWGVrqNQZdQ3/YdcBoMIB+6J0ZucBoMIB+rJwLZ:a2ujdbQ3kcBoMIB+6hcBoMIB+r6
- MD5 SHA1 SHA512 SSDEEP