Overview

overview

9

Static

static

3

2024-09-25...il.exe

windows7-x64

9

2024-09-25...il.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2024, 11:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-25_0273a609c7705dd4d44514357d746445_avoslocker_magniber_revil.exe

  • Size

    21.9MB

  • MD5

    0273a609c7705dd4d44514357d746445

  • SHA1

    a3201cb1f6f72dd334db40e83e1eb22a0db23369

  • SHA256

    4f428aab5f909f6ad07881bf08c1e1ceb160c4a1cb53ac9eabb664f7b46487d8

  • SHA512

    e7aa8557b2c90bd5c5e2c4f0ea14818fa6a2264c9f05eac34b1ad705db3038832a1253a4e88903eda793952ec0db065fad775848bf2a88049a241c232c46ab81

  • SSDEEP

    393216:SK/kMxi5h4DreSca8KlcQnbdBHQVfacMFgXnU7sEl2yD:uh49bbdmVrtXnas

Score
9/10
discoveryevasion

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-25_0273a609c7705dd4d44514357d746445_avoslocker_magniber_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-25_0273a609c7705dd4d44514357d746445_avoslocker_magniber_revil.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Users\Admin\AppData\Local\Temp\ytool\UUTmNE67emFKI0O.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-09-25_0273a609c7705dd4d44514357d746445_avoslocker_magniber_revil.exe" "C:\Users\Admin\AppData\Local\Temp\2024-09-25_0273a609c7705dd4d44514357d746445_avoslocker_magniber_revil.exe"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3460
    • C:\Users\Admin\AppData\Local\Temp\V23龙图江湖.exe
      "C:\Users\Admin\AppData\Local\Temp\V23龙图江湖.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\V23龙图江湖.exe
    Filesize

    11.9MB

    MD5

    08689dd6ca7e0ec325b17dad0ad092bf

    SHA1

    aa08b7ea773059bfa89d2c3cab8d1b2db84a4dea

    SHA256

    a4252fc505b8945c522db88539b15d291d0d569edbdec2a0321f4aa9b53a1c37

    SHA512

    d5c872fa6c040dbe56f1bcb2101f17d36d8ec3444541bc65eb258d85d77947a4e50a156f2132a5d3cc66527cba7bb2df53dbb3f1b9ab61fd33ab93b40333a2bd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log
    Filesize

    314B

    MD5

    44784ec8dd0af6bae90745b3bcac04fe

    SHA1

    d06530374420eb0a505d215c95c1290ca967974b

    SHA256

    649adc9884d3b85ed8c616fe842cb0bce30f07702cea986037f310c12bd559d7

    SHA512

    14e80d4e62c34c42d8d1790d48a4054ac8199462b3d25564970df96b5ea4ea2442c607a09a08f52bcd6b128a392480ce1a4d9db6e3cc8c103fc1ed7f6312eda0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log
    Filesize

    656B

    MD5

    181376cc9e875ef7d3cdfc4b6e1ee042

    SHA1

    3daa8a81aaa57d7a817887d76d120afb89dc207d

    SHA256

    b6cd0f368d5a4432231ac9bfb498215267e46f68a8bf93759c43478d52a8e52f

    SHA512

    54c74726a54dd4f75dd725c91a372c5e26068d64295dca4e108eb182088a1c871842ec85170b55785947b66be8f095e899ffae466b80bf8e02c207f35b872ae6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log
    Filesize

    4KB

    MD5

    bf12b7b466b76323e9835ac48862f20b

    SHA1

    01629e7daaf5226518a3455aec32cd260513de9b

    SHA256

    3f800d52199e577bbc9c35f1220bb620e3f74046fa039b15565a9d62b169a8a1

    SHA512

    0ebfe8260752a91df50499284ae24d676b52726112b53fcd26f2ba8f408bf6ce5298d904d553e3cb50ef48517d7f2e7fc489de5be7fcdfd5c9b41bb237a8c675

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ytool\UUTmNE67emFKI0O.exe
    Filesize

    5.7MB

    MD5

    b942a68c780cd816942022d57fb3288a

    SHA1

    3416786a91722d56b41e0d1c904ff3051e0e8d7c

    SHA256

    051bf75d8748e00720d04be13acf71290e18b32a4cf14a8a39e318c44814bde7

    SHA512

    c0b1a00b0bc408b8f930f68006dfff72244e85e8f06b1c1ce058feadd9d4d2cb0680daed5003d3c53485cf8eb65431a307f00a8c4474316187d41a1237195f56

    Download Submit