Overview

overview

9

Static

static

3

2024-09-25...il.exe

windows7-x64

9

2024-09-25...il.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25-09-2024 11:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-25_0273a609c7705dd4d44514357d746445_avoslocker_magniber_revil.exe

  • Size

    21.9MB

  • MD5

    0273a609c7705dd4d44514357d746445

  • SHA1

    a3201cb1f6f72dd334db40e83e1eb22a0db23369

  • SHA256

    4f428aab5f909f6ad07881bf08c1e1ceb160c4a1cb53ac9eabb664f7b46487d8

  • SHA512

    e7aa8557b2c90bd5c5e2c4f0ea14818fa6a2264c9f05eac34b1ad705db3038832a1253a4e88903eda793952ec0db065fad775848bf2a88049a241c232c46ab81

  • SSDEEP

    393216:SK/kMxi5h4DreSca8KlcQnbdBHQVfacMFgXnU7sEl2yD:uh49bbdmVrtXnas

Score
9/10
discoveryevasion

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-25_0273a609c7705dd4d44514357d746445_avoslocker_magniber_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-25_0273a609c7705dd4d44514357d746445_avoslocker_magniber_revil.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\ytool\UUTmNE67emFKI0O.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-09-25_0273a609c7705dd4d44514357d746445_avoslocker_magniber_revil.exe" "C:\Users\Admin\AppData\Local\Temp\2024-09-25_0273a609c7705dd4d44514357d746445_avoslocker_magniber_revil.exe"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1100
    • C:\Users\Admin\AppData\Local\Temp\V23龙图江湖.exe
      "C:\Users\Admin\AppData\Local\Temp\V23龙图江湖.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\V23龙图江湖.exe
    Filesize

    11.9MB

    MD5

    08689dd6ca7e0ec325b17dad0ad092bf

    SHA1

    aa08b7ea773059bfa89d2c3cab8d1b2db84a4dea

    SHA256

    a4252fc505b8945c522db88539b15d291d0d569edbdec2a0321f4aa9b53a1c37

    SHA512

    d5c872fa6c040dbe56f1bcb2101f17d36d8ec3444541bc65eb258d85d77947a4e50a156f2132a5d3cc66527cba7bb2df53dbb3f1b9ab61fd33ab93b40333a2bd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log
    Filesize

    4KB

    MD5

    80c6cf0e79985c27493dcbe67b97d9c5

    SHA1

    1202c44cd41b155fd7f348dabe39e81633c29084

    SHA256

    2cf8b29dd55e4d003a9e789aae60f430854289a67cec69b53192f5518654524b

    SHA512

    670039523ba8c7864447baeb21140c0d84c0060012b7645a7d1e3790469158015ee19e56a1c3f4d70ca9d271c5d2b10c1c8454ac53f2236d2a4c241da4ce09e7

    Download Submit

  • \Users\Admin\AppData\Local\Temp\ytool\UUTmNE67emFKI0O.exe
    Filesize

    5.7MB

    MD5

    b942a68c780cd816942022d57fb3288a

    SHA1

    3416786a91722d56b41e0d1c904ff3051e0e8d7c

    SHA256

    051bf75d8748e00720d04be13acf71290e18b32a4cf14a8a39e318c44814bde7

    SHA512

    c0b1a00b0bc408b8f930f68006dfff72244e85e8f06b1c1ce058feadd9d4d2cb0680daed5003d3c53485cf8eb65431a307f00a8c4474316187d41a1237195f56

    Download Submit