Overview
overview
7Static
static
7MegaDownloader.exe
windows7-x64
7MegaDownloader.exe
windows10-2004-x64
7MegaVPN.exe
windows7-x64
1MegaVPN.exe
windows10-2004-x64
1Microsoft....es.dll
windows7-x64
1Microsoft....es.dll
windows10-2004-x64
1Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1ObjectListView.dll
windows7-x64
1ObjectListView.dll
windows10-2004-x64
1SharpCompress.dll
windows7-x64
1SharpCompress.dll
windows10-2004-x64
1System.AppContext.dll
windows7-x64
1System.AppContext.dll
windows10-2004-x64
1System.Buffers.dll
windows7-x64
1System.Buffers.dll
windows10-2004-x64
1System.Console.dll
windows7-x64
1System.Console.dll
windows10-2004-x64
1System.Glo...rs.dll
windows7-x64
1System.Glo...rs.dll
windows10-2004-x64
1System.IO....le.dll
windows7-x64
1System.IO....le.dll
windows10-2004-x64
1System.IO....on.dll
windows7-x64
1System.IO....on.dll
windows10-2004-x64
1System.IO....es.dll
windows7-x64
1System.IO....es.dll
windows10-2004-x64
1System.IO....em.dll
windows7-x64
1System.IO....em.dll
windows10-2004-x64
1System.Memory.dll
windows7-x64
1System.Memory.dll
windows10-2004-x64
1System.Net.Http.dll
windows7-x64
1System.Net.Http.dll
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2024 17:33
Behavioral task
behavioral1
Sample
MegaDownloader.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
MegaDownloader.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
MegaVPN.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
MegaVPN.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Microsoft.Win32.Primitives.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Microsoft.Win32.Primitives.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ObjectListView.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
ObjectListView.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
SharpCompress.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
SharpCompress.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
System.AppContext.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
System.AppContext.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
System.Buffers.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
System.Buffers.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
System.Console.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
System.Console.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral19
Sample
System.Globalization.Calendars.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
System.Globalization.Calendars.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
System.IO.Compression.ZipFile.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
System.IO.Compression.ZipFile.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
System.IO.Compression.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
System.IO.Compression.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
System.IO.FileSystem.Primitives.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
System.IO.FileSystem.Primitives.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
System.IO.FileSystem.dll
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
System.IO.FileSystem.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
System.Memory.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
System.Memory.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
System.Net.Http.dll
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
System.Net.Http.dll
Resource
win10v2004-20240802-en
General
-
Target
MegaDownloader.exe
-
Size
5.8MB
-
MD5
159ec5b2998e5b7c030860c5810926b8
-
SHA1
ed26fbc1f348222347bff125a2869051a1b80703
-
SHA256
f1d28cf27891791b0b8f45612642be6ff62da691d726e23802c0471364251b89
-
SHA512
a8006271f35141dc9c2c39f9ad364e283e4dcdd032a86539a3e5685dacf1e1c51cd7104402d74df0b44b65c516e0b7d1236516dbc53d172c769f96de583e7126
-
SSDEEP
98304:AbW/CQrd9ttwvJm+BaN6tC3Lo9NdD5x/rKUjFNxvLWB:Abvu9t+v0+Bqp3LONdD5NeUjFNxvLW
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/2008-8-0x00000201F96C0000-0x00000201F971A000-memory.dmp agile_net -
Modifies registry class 7 IoCs
Processes:
MegaDownloader.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mega\ = "URL: mega Protocol" MegaDownloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mega\URL Protocol MegaDownloader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mega\shell\open\command MegaDownloader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mega\shell MegaDownloader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mega\shell\open MegaDownloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mega\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\MegaDownloader.exe\" %1" MegaDownloader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mega MegaDownloader.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
MegaDownloader.exepid process 2008 MegaDownloader.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MegaDownloader.exepid process 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe 2008 MegaDownloader.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
MegaDownloader.exedescription pid process Token: SeDebugPrivilege 2008 MegaDownloader.exe Token: 33 2008 MegaDownloader.exe Token: SeIncBasePriorityPrivilege 2008 MegaDownloader.exe Token: 33 2008 MegaDownloader.exe Token: SeIncBasePriorityPrivilege 2008 MegaDownloader.exe Token: 33 2008 MegaDownloader.exe Token: SeIncBasePriorityPrivilege 2008 MegaDownloader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MegaDownloader.exe"C:\Users\Admin\AppData\Local\Temp\MegaDownloader.exe"1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3440
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD593e68a613f33169bc0ef56c39f8e5b66
SHA180e3d00cbd49791703098ff6fa683b5be81238aa
SHA256bc758d067d03984110c21cc76115807be4831bbd0fec92ca4076773d5417f51e
SHA5122b6e65853ad27130797f7f765d8b68b353ac9946d8893eae80a9e213ee680f4b4619bf5bf747f1e7570e494f73ffdf445b3cb4a4d7207d904d28115004da8eb0