Overview
overview
7Static
static
7MegaDownloader.exe
windows7-x64
7MegaDownloader.exe
windows10-2004-x64
7MegaVPN.exe
windows7-x64
1MegaVPN.exe
windows10-2004-x64
1Microsoft....es.dll
windows7-x64
1Microsoft....es.dll
windows10-2004-x64
1Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1ObjectListView.dll
windows7-x64
1ObjectListView.dll
windows10-2004-x64
1SharpCompress.dll
windows7-x64
1SharpCompress.dll
windows10-2004-x64
1System.AppContext.dll
windows7-x64
1System.AppContext.dll
windows10-2004-x64
1System.Buffers.dll
windows7-x64
1System.Buffers.dll
windows10-2004-x64
1System.Console.dll
windows7-x64
1System.Console.dll
windows10-2004-x64
1System.Glo...rs.dll
windows7-x64
1System.Glo...rs.dll
windows10-2004-x64
1System.IO....le.dll
windows7-x64
1System.IO....le.dll
windows10-2004-x64
1System.IO....on.dll
windows7-x64
1System.IO....on.dll
windows10-2004-x64
1System.IO....es.dll
windows7-x64
1System.IO....es.dll
windows10-2004-x64
1System.IO....em.dll
windows7-x64
1System.IO....em.dll
windows10-2004-x64
1System.Memory.dll
windows7-x64
1System.Memory.dll
windows10-2004-x64
1System.Net.Http.dll
windows7-x64
1System.Net.Http.dll
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-09-2024 17:33
Behavioral task
behavioral1
Sample
MegaDownloader.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
MegaDownloader.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
MegaVPN.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
MegaVPN.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Microsoft.Win32.Primitives.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Microsoft.Win32.Primitives.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ObjectListView.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
ObjectListView.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
SharpCompress.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
SharpCompress.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
System.AppContext.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
System.AppContext.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
System.Buffers.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
System.Buffers.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
System.Console.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
System.Console.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral19
Sample
System.Globalization.Calendars.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
System.Globalization.Calendars.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
System.IO.Compression.ZipFile.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
System.IO.Compression.ZipFile.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
System.IO.Compression.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
System.IO.Compression.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
System.IO.FileSystem.Primitives.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
System.IO.FileSystem.Primitives.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
System.IO.FileSystem.dll
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
System.IO.FileSystem.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
System.Memory.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
System.Memory.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
System.Net.Http.dll
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
System.Net.Http.dll
Resource
win10v2004-20240802-en
General
-
Target
MegaDownloader.exe
-
Size
5.8MB
-
MD5
159ec5b2998e5b7c030860c5810926b8
-
SHA1
ed26fbc1f348222347bff125a2869051a1b80703
-
SHA256
f1d28cf27891791b0b8f45612642be6ff62da691d726e23802c0471364251b89
-
SHA512
a8006271f35141dc9c2c39f9ad364e283e4dcdd032a86539a3e5685dacf1e1c51cd7104402d74df0b44b65c516e0b7d1236516dbc53d172c769f96de583e7126
-
SSDEEP
98304:AbW/CQrd9ttwvJm+BaN6tC3Lo9NdD5x/rKUjFNxvLWB:Abvu9t+v0+Bqp3LONdD5NeUjFNxvLW
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1924-8-0x000000001AD00000-0x000000001AD5A000-memory.dmp agile_net -
Modifies registry class 7 IoCs
Processes:
MegaDownloader.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mega\shell\open MegaDownloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mega\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\MegaDownloader.exe\" %1" MegaDownloader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mega MegaDownloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mega\ = "URL: mega Protocol" MegaDownloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mega\URL Protocol MegaDownloader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mega\shell\open\command MegaDownloader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mega\shell MegaDownloader.exe -
Processes:
MegaDownloader.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 MegaDownloader.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 MegaDownloader.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
MegaDownloader.exepid process 1924 MegaDownloader.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MegaDownloader.exepid process 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe 1924 MegaDownloader.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
MegaDownloader.exedescription pid process Token: SeDebugPrivilege 1924 MegaDownloader.exe Token: 33 1924 MegaDownloader.exe Token: SeIncBasePriorityPrivilege 1924 MegaDownloader.exe Token: 33 1924 MegaDownloader.exe Token: SeIncBasePriorityPrivilege 1924 MegaDownloader.exe Token: 33 1924 MegaDownloader.exe Token: SeIncBasePriorityPrivilege 1924 MegaDownloader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MegaDownloader.exe"C:\Users\Admin\AppData\Local\Temp\MegaDownloader.exe"1⤵
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56560511fc7c974d1a54fd7743ccad528
SHA1cd2535ba05fcf75373e4e317241ca177f8a673f8
SHA256c4fdaaf63603e37f200ae6d66093602930a092ccdaba496c97a81e0baa19decd
SHA512fd3f9d1b2d0297e69fcd225dc2b26d5c593952101e6119eba4d822beaa3750f593ae2abc0c96e8dc2924190183d5be9fe9db086b4c7219a51f483ca0d2477cfb
-
Filesize
32KB
MD593e68a613f33169bc0ef56c39f8e5b66
SHA180e3d00cbd49791703098ff6fa683b5be81238aa
SHA256bc758d067d03984110c21cc76115807be4831bbd0fec92ca4076773d5417f51e
SHA5122b6e65853ad27130797f7f765d8b68b353ac9946d8893eae80a9e213ee680f4b4619bf5bf747f1e7570e494f73ffdf445b3cb4a4d7207d904d28115004da8eb0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b