Overview

overview

10

Static

static

10

2024-05-12...il.exe

windows7-x64

10

2024-05-12...il.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 01:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-12_0477d08525fced756cd9a795fcf3ee6a_avoslocker_magniber_metamorfo_revil.exe
  • Size 15.4MB
  • Sample240512-bryvmscg45
  • SHA256 f991276b051f0518cf476eed498a8da4c77e20a00f495d9b724cc7b265f5e5a4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
privateloaderloader

Malware Config

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Executes dropped EXE 1 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-12_0477d08525fced756cd9a795fcf3ee6a_avoslocker_magniber_metamorfo_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-12_0477d08525fced756cd9a795fcf3ee6a_avoslocker_magniber_metamorfo_revil.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Users\Admin\AppData\Local\Temp\5e2cd780-c911-48ab-87a8-980b23c7109e\SodaPDFDesktop14_14.0.210.2379.exe
      C:\Users\Admin\AppData\Local\Temp\5e2cd780-c911-48ab-87a8-980b23c7109e\SodaPDFDesktop14_14.0.210.2379.exe /update=start
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:692

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
        • Size 1KB
        • SHA256 cfbfd4e4823ff77810a1813805a40c45a58bc863c35cadd748d2baad824f0d56
        • MD5 SHA1 SHA512
        Submit Download

        CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
        • Size 724B
        • SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
        • MD5 SHA1 SHA512
        Submit Download

        24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
        • Size 410B
        • SHA256 e6f29804dd3fd95e3b1ca20ea8f78e505dff760392a53b7e4cfd9e8e28c802ba
        • MD5 SHA1 SHA512
        Submit Download

        CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
        • Size 392B
        • SHA256 e09d32d357314e10b3818e34b4e793fd75f1f3e1f3bb59538cd27ad14465d9db
        • MD5 SHA1 SHA512
        Submit Download

        SodaPDFDesktop14_14.0.210.2379.exe
        • Path C:\Users\Admin\AppData\Local\Temp\5e2cd780-c911-48ab-87a8-980b23c7109e\SodaPDFDesktop14_14.0.210.2379.exe
        • Size 15.4MB
        • SHA256 f991276b051f0518cf476eed498a8da4c77e20a00f495d9b724cc7b265f5e5a4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download