Analysis
-
max time kernel
141s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
04-07-2024 09:32
General
-
Target
2024-07-04_5b1a2efb975c9f0ec331d46b7b95d87c_magniber_plugx_revil_sliver.exe
-
Size
274.0MB
-
MD5
5b1a2efb975c9f0ec331d46b7b95d87c
-
SHA1
645b1580d9ab88eba0c148d9cca5b90f8b872916
-
SHA256
a60f27782bf07d0803e92df36a1d637c714dcc6e88954c28ea4ffa8f0a37ecdb
-
SHA512
861e816f9e6caacbedf0fea9b39698d092e3e47bf0692accdf95daa8e59bb5f62e14c83f496c3d215d7d5d5d7200cc512a39e8b2119be44322cce5606f1c44ff
-
SSDEEP
6291456:a4V2wDtDnnqivo3DDONeIE2wDtDnnXuu6xQqrrgLL5C0+W:ntDq+oPONeZtDXuu6xQqr0JC0H
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-04_5b1a2efb975c9f0ec331d46b7b95d87c_magniber_plugx_revil_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-04_5b1a2efb975c9f0ec331d46b7b95d87c_magniber_plugx_revil_sliver.exe"1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow