Overview

overview

9

Static

static

1

2024-05-30...er.exe

windows7-x64

1

2024-05-30...er.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2024 15:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-30_d13af843c4500fa4d2da5a4a16612b28_floxif_magniber.exe

  • Size

    5.3MB

  • MD5

    d13af843c4500fa4d2da5a4a16612b28

  • SHA1

    1dec7f76965fcd9a2210ba2b8e45344a4a16795f

  • SHA256

    9196135e1ba4629d12391971e742232698e10ae622038ae60ca91ebb14a115d3

  • SHA512

    6a3b10de2d30a058a99e97ca3a81cfe1f5375602e9aabae12cc285f367a0d1c86bc77952d996f55c6ebb2db4985555972cbf4157ee1a745322ae9a2f4ff474a2

  • SSDEEP

    98304:FlvB6kscWU+MeTMv6dGg/hffXo1CCJc2m+Fysu39:Hgk7+F0gZgCCW2dQsc9

Score
9/10
upx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 3 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 1 IoCs
  • Program crash 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-30_d13af843c4500fa4d2da5a4a16612b28_floxif_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-30_d13af843c4500fa4d2da5a4a16612b28_floxif_magniber.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1596
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 524
      2⤵
      • Program crash
      PID:4748
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 540
      2⤵
      • Program crash
      PID:1956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 548
      2⤵
      • Program crash
      PID:348
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 636
      2⤵
      • Program crash
      PID:2800
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 644
      2⤵
      • Program crash
      PID:1392
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1596 -ip 1596
    1⤵
      PID:1516
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 1596 -ip 1596
      1⤵
        PID:1384
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1596 -ip 1596
        1⤵
          PID:4108
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1596 -ip 1596
          1⤵
            PID:3660
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1596 -ip 1596
            1⤵
              PID:1116
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4168 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
              1⤵
                PID:2428

              Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files\Common Files\System\symsrv.dll
                Filesize

                67KB

                MD5

                7574cf2c64f35161ab1292e2f532aabf

                SHA1

                14ba3fa927a06224dfe587014299e834def4644f

                SHA256

                de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

                SHA512

                4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

                Download Submit

              • memory/1596-3-0x0000000010000000-0x0000000010030000-memory.dmp

                Filesize

                192KB

                Download

              • memory/1596-7-0x0000000010000000-0x0000000010030000-memory.dmp

                Filesize

                192KB

                Download

              • memory/1596-5-0x0000000000520000-0x0000000001186000-memory.dmp

                Filesize

                12.4MB

                Download