Analysis

  • max time kernel
    147s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 10:07

General

  • Target

    2024-06-26_6c1b0d7bf60d6e2272d495a5f1c17553_magniber_revil.exe

  • Size

    11.7MB

  • MD5

    6c1b0d7bf60d6e2272d495a5f1c17553

  • SHA1

    0ca95d2b94f688553b1ae4f9f60cf32a440220c6

  • SHA256

    6a9ca3b9310f2e3afb7937aa579bce78043f1dedd680db0e2581003cd193d25e

  • SHA512

    0c08a6e6fa4dfd4feacb3f78e167a81d589d964cf90699d5af92a7e3e2040823a1923e64cfb429a2c6c366618fb7dae1d5583727290ebd189166a508f90716fe

  • SSDEEP

    196608:kNym2iBYGfsV3YBukMDHMD+cpvJ/4H3nmghWoa/fsysMF4JD85lLkjiX:kN4H3YBjMDHMFgXnU7sElLy

Score
9/10

Malware Config

Signatures

  • Detects executables packed with VMProtect. 4 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • UPX dump on OEP (original entry point) 2 IoCs
  • Executes dropped EXE 2 IoCs
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-26_6c1b0d7bf60d6e2272d495a5f1c17553_magniber_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-26_6c1b0d7bf60d6e2272d495a5f1c17553_magniber_revil.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4424
    • C:\Users\Admin\AppData\Local\Temp\ytool\QJxCtGAG7YVM6iM.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-26_6c1b0d7bf60d6e2272d495a5f1c17553_magniber_revil.exe" "C:\Users\Admin\AppData\Local\Temp\2024-06-26_6c1b0d7bf60d6e2272d495a5f1c17553_magniber_revil.exe"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:372
    • C:\Users\Admin\AppData\Local\Temp\请勿点击.exe
      "C:\Users\Admin\AppData\Local\Temp\请勿点击.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2296
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe
        3⤵
          PID:1948
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4232,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:8
      1⤵
        PID:676

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\ISocket.dll

        Filesize

        295KB

        MD5

        6db6dcfe126984a341cecfc5be783f48

        SHA1

        98309871ad417694bafd93d44eb71180b79cdd45

        SHA256

        8adf02829208ea32bdb377e8fccfd106393611e9425d980ce39a8dac17150dac

        SHA512

        d4848676f2eb202ccc8f56f8389c53db0335f0ccc99ec4481e1c9978c2664519a0ffad0e8b53cc0bb56ae7ddf1cd041e225200b807a5808027c863d8094fcdc3

      • C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log

        Filesize

        311B

        MD5

        e6736f4020355906932d79092ae7a86e

        SHA1

        5b7aed66234a6eaa335abf5ccdbc1cdbf47483c1

        SHA256

        265917add7da5bcec955d7ee764b74637a34d165e2ae11735a516ea13ad3fe34

        SHA512

        167ca9bf24b9368975b0ff07b0642edc68e12dd7d073ff3aad02b284ca9407494218d81ace24790775f1195ab374126b6d7546ac2644c7605fbd4c4184d2cc73

      • C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log

        Filesize

        648B

        MD5

        298ec1d57504e254eb6b3974adc315d1

        SHA1

        f48f0674519c1722d961f418664d2f22707bc753

        SHA256

        3e7d0cd1443bd5738effbf61f01e27022cc469c7187adfb71734617a83bbb601

        SHA512

        8ce93d2a3bb4563b3b2166d8e3b45100f7ef9ca908596383766055c61b21f2851cc9aa1cc7f92b510023a90e66e91ae448a85c1149cba4f9758ba20b0843540e

      • C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log

        Filesize

        4KB

        MD5

        2fc54e49f5935480bf7d766d26e08578

        SHA1

        490cca149c5a8799ff64fc035e4589c72d245bf2

        SHA256

        7d8f4cd8e08cdcc8a4d3c9232699a9c3f2ffe26eb3d993f4f6e504c04a539952

        SHA512

        9e760d9f58d20c3ec394068ccf39382f98e5e5031922a7971249718b00ff796dd3ede785a43e5e1f13f8a56143480fe167b52ac0f81eec934034f9ea054b4a47

      • C:\Users\Admin\AppData\Local\Temp\ytool\QJxCtGAG7YVM6iM.exe

        Filesize

        5.7MB

        MD5

        631cbea327373843c7193404da2f7b49

        SHA1

        a1743aeb4d79877ed831617b733a41b477d16481

        SHA256

        7c887a2b87da1faa449896903127b70b904430b2d9f123d811821e3ea720c49a

        SHA512

        5fb96abde331e0e85c3f0b61326e26f4d336ef36e587f423e0202d9d74f076425bd9dc521425a4c63c4d53d81c62713e16b975f5ca0eb5209b2f54e0793f3f77

      • C:\Users\Admin\AppData\Local\Temp\请勿点击.exe

        Filesize

        3.1MB

        MD5

        5a716b52188c8226cf75fc626844b4c5

        SHA1

        3ea374fe53812157b72922b548a68374794644d2

        SHA256

        1c349bcb071020e192ddadd8e02b0daa611dfa661cc0d5a8ea6ba6122412424a

        SHA512

        9264ed289f4e627f501a0cf4987ad802502daa9fa8ee8a74a8771161f9a19fc3025b46bdac6fab7c33f9d0688eb5380c1932f50172c75a8cb6dbba62bdc29a4d

      • memory/2296-20-0x0000000000400000-0x00000000009EA000-memory.dmp

        Filesize

        5.9MB

      • memory/2296-21-0x0000000000400000-0x00000000009EA000-memory.dmp

        Filesize

        5.9MB

      • memory/2296-39-0x0000000000400000-0x00000000009EA000-memory.dmp

        Filesize

        5.9MB