Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 11:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe
-
Size
9.5MB
-
MD5
223a1d228be03d8332fcde7c816ba757
-
SHA1
d859af22da6b1064727f7699b32e1dfcda3f4b69
-
SHA256
48bdcaf01c5274feac44487ac7f480c2d7d41c0fb15ba3fc79ae6fc30834cb38
-
SHA512
07b8b4252ab8d692ce54df9e92bccaa6dfb7467a31acc9fd7a5938619976a453c2a59c0a97e360259549bfa552ae1b1271a3cac480b233c2954b3168c9ffe4d3
-
SSDEEP
196608:fF+D+hL6obPHrvIZLfqrxwdgSb7UFbn/QENiE57I4r//JyM2t:fF+D+hL6obPHrQZLfqdwHqLIE57I47UH
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exedescription pid process target process PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 set thread context of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe -
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3224 1360 WerFault.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 3788 2624 WerFault.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 3684 2624 WerFault.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 4248 1360 WerFault.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 4908 2624 WerFault.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 4512 2624 WerFault.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 3268 2624 WerFault.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2640 2624 WerFault.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 3212 1360 WerFault.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe -
Modifies registry class 10 IoCs
Processes:
2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD6C80E-3F67-7AF0-51E8-F4257BF153AA}\Implemented Categories 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD6C80E-3F67-7AF0-51E8-F4257BF153AA}\InprocServer32 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD6C80E-3F67-7AF0-51E8-F4257BF153AA}\InprocServer32\ = "C:\\Windows\\SysWOW64\\MSCorEE.dll" 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD6C80E-3F67-7AF0-51E8-F4257BF153AA}\InprocServer32\Class = "Microsoft.Vsa.Vb.CodeDOM.Location" 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD6C80E-3F67-7AF0-51E8-F4257BF153AA}\InprocServer32\RuntimeVersion = "v2.0.50727" 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD6C80E-3F67-7AF0-51E8-F4257BF153AA}\InprocServer32\ThreadingModel = "Both" 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD6C80E-3F67-7AF0-51E8-F4257BF153AA} 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD6C80E-3F67-7AF0-51E8-F4257BF153AA}\ = "Microsoft.Vsa.Vb.CodeDOM.Location" 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD6C80E-3F67-7AF0-51E8-F4257BF153AA}\Implemented Categories\{62C8FE65-4EBB-45E7-B440-6E39B2CDBF29} 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD6C80E-3F67-7AF0-51E8-F4257BF153AA}\InprocServer32\Assembly = "Microsoft.Vsa.Vb.CodeDOMProcessor, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exedescription pid process Token: 33 2624 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe Token: SeIncBasePriorityPrivilege 2624 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe Token: 33 2624 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe Token: SeIncBasePriorityPrivilege 2624 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exepid process 2624 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exepid process 2624 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exepid process 2624 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2624 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exedescription pid process target process PID 1360 wrote to memory of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 wrote to memory of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 wrote to memory of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 wrote to memory of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe PID 1360 wrote to memory of 2624 1360 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe 2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 5602⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_223a1d228be03d8332fcde7c816ba757_mafia_magniber_revil.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 5763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 8923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 8563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 7443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 6802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 7762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1360 -ip 13601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1360 -ip 13601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1360 -ip 13601⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1360-1-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/1360-54-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-18-0x0000000004530000-0x0000000004550000-memory.dmpFilesize
128KB
-
memory/2624-13-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-53-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-63-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-16-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-10-0x0000000004AD0000-0x0000000004CDD000-memory.dmpFilesize
2.1MB
-
memory/2624-17-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-19-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-22-0x0000000004AD0000-0x0000000004CDD000-memory.dmpFilesize
2.1MB
-
memory/2624-21-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-28-0x0000000004AD0000-0x0000000004CDD000-memory.dmpFilesize
2.1MB
-
memory/2624-40-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-184-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-4-0x0000000004AD0000-0x0000000004CDD000-memory.dmpFilesize
2.1MB
-
memory/2624-15-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-74-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-85-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-94-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-107-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-118-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-129-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-138-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-151-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-162-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-171-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB
-
memory/2624-3-0x0000000000400000-0x00000000026C2000-memory.dmpFilesize
34.8MB