Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03-07-2024 05:56
General
-
Target
2024-07-03_d24709c1cbe70f894ce0e534713d5c8c_magniber_metamorfo.exe
-
Size
14.3MB
-
MD5
d24709c1cbe70f894ce0e534713d5c8c
-
SHA1
4efd7b1c6c1bf6086be0ddd73c5fc74a3007831a
-
SHA256
24b66b08757ca85c39ae509ad4db00df41882ea44f7fde2ab25012d976a34512
-
SHA512
ebff0c0140f03be32e790d22f7d69feea517257883dc16db596a7cea654ab4f6a81f730dc17f3b3bb053b8b3aaa61117712267294cf437cb3c5158297d3db905
-
SSDEEP
196608:z1ygZUo9Eg8m9/aGHZYik/XE0h1NKWd+EoPUubzoGZFB4IS+9G0eBF/6FLOyomFM:JygTEamM20WdcPU8oGZFBVeBUFqJbn
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 6 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_d24709c1cbe70f894ce0e534713d5c8c_magniber_metamorfo.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_d24709c1cbe70f894ce0e534713d5c8c_magniber_metamorfo.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_d24709c1cbe70f894ce0e534713d5c8c_magniber_metamorfo.exeC:\Users\Admin\AppData\Local\Temp\2024-07-03_d24709c1cbe70f894ce0e534713d5c8c_magniber_metamorfo.exe 400339035F03530371036C036403710362036E0347036203770362035F0367036603660373037003600362036D035F0362036603330353033003480335035C034403510357036C03740346036B0330034B0336035F034403410356033B0337036203360375033B03--aa`2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\deepscan\ae0P3K6_GRTowEh3H5\GBU84a5v8.exe"C:\ProgramData\deepscan\ae0P3K6_GRTowEh3H5\GBU84a5v8.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD57721777df2350ff195203cc7d7fe12c5
SHA1a434eee80a389fef7f4d9886ec23bc7c8fcb2e64
SHA256af3f9d480936286ce799ed5422222d3feabbc2325cb8242c2d09937964e73916
SHA512e94d1dc08cc7dbf98e50f933adc94b37e96ae4738eaff4c62c4901e9a38e67bbaa316e8ee770497b44257c7bfeca6a5924294f980b54a9da049d074fa63c4d41
-
Filesize
145B
MD5b91537ac1d6ae8b869414e90e541226a
SHA16655156495014c03c84ff4d2b1461bdbfa366a34
SHA256fa156c38f4e8504fd71d04162c7e628c06b340254d047b806d083fe8e148ef4e
SHA512f70179452e642d0987136f22ce2349795a599cdcaa9ff6c3b02020c6682fc63f4e5aab729cd34a1f803f66fd9533e29df8af693ccb6044ec1865ef7bc593446f
-
Filesize
4.2MB
MD5e1629a36f15824346bb54a9ebe9b622f
SHA1ee5d55315ffb351e24b7c918c82e6ce4ec17a645
SHA25668df186e26151313a0df2adb0ef5f3a45ebba3cb02229bd8723a29dee60e278d
SHA5120301ed7ad473015478f32afd3e41dafd045eab26ad42080bad6030324564a7ed09a7516b8d362b5cb2201d087eb25f2bb7ac5fc809a387f49f893ac3df8814bb
-
Filesize
444KB
MD5fd5cabbe52272bd76007b68186ebaf00
SHA1efd1e306c1092c17f6944cc6bf9a1bfad4d14613
SHA25687c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
SHA5121563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
-
Filesize
948KB
MD5034ccadc1c073e4216e9466b720f9849
SHA1f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA25686e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
SHA5125f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
-
Filesize
186KB
MD5feec59aca478ffd02bf81ec4a02768f1
SHA10a68219e91fd2f7a413b974a9ea22253ba9a6376
SHA256c7d5fb1cdc4a2f6321c6e74538092a9ec6f2038d48c18132f77162b0064cd922
SHA51223411c62d93b6107c1b3df2ee0ea7bfe62325483ecbc2653c17a66f6f5d4a1f2818b6be109f35b309d26d5733c379efbd2879d853e2c3f78b1ad4fc697c5a605
-
Filesize
255KB
MD5fa9d7d6498f69a3f129555856b8e57d6
SHA1ded693730bd80767884d78c522c9d8d0061958db
SHA2563ab66b2fd3173e71318175f19908331d7e3b442b14d3e39f0f10014f64f716ad
SHA512235bf1dfd22c6a30e8df6737218c7968901192907db2846a43684d006f4159e0b16a4ecb0a3e67217c33778924bb6e05b8a963fc148df33190e4ba41b119dd8c
-
Filesize
3.6MB
MD55228e43586fecc4fddcc0b83c5eb8ca8
SHA1067318f0384f0f4654ceb86bc8e236ecc6bbf2ab
SHA256ff8d02b39861c247cb69bfc209005ff567171d69db7586faeb9cc80b839d9a55
SHA5125dd72fd92f0e0a3ea4ff164321238c3da2a1d7b4786704db6c1ce4f8eb77133e6bfbbe00f429037d26d928b1a288e547a7434c81b6bcfb48d92c87731dbf0667
-
Filesize
564KB
-
Filesize
924KB
-
Filesize
7.0MB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
564KB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
7.0MB
-
Filesize
7.0MB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
924KB