Analysis

  • max time kernel
    118s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2024, 01:15

General

  • Target

    2024-10-16_1feb149f99f559fc0c204359a6ae4abe_magniber_revil.exe

  • Size

    15.5MB

  • MD5

    1feb149f99f559fc0c204359a6ae4abe

  • SHA1

    e208b62afa9e3d64d467d3ffbab39df6052f6301

  • SHA256

    be204886720c44fa29e5e6757f1bac479353d931c75399a58de2b3ccb7cd2834

  • SHA512

    f632fd9441f8b1f8e19a4d6cf9a59daed1af38cb10a1a1c9c0a53c72930d04516434ce9087332c2567c95965b3d76e89072c658517157a7fd826fa1d228798eb

  • SSDEEP

    196608:Tulbx5VjzHeMf3Xnn28luJADGD2yJrqNh+zzfNNa1G:Tulrtz13XnIODnyJrqNm

Malware Config

Signatures

  • Downloads MZ/PE file
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks for any installed AV software in registry 1 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-16_1feb149f99f559fc0c204359a6ae4abe_magniber_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-16_1feb149f99f559fc0c204359a6ae4abe_magniber_revil.exe"
    1⤵
    • Checks for any installed AV software in registry
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2580

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log

          Filesize

          512KB

          MD5

          79456bcf2e25664215de2bfaf08c4ec9

          SHA1

          9138143ec4b0fbbc7fd01e702816021192831f0c

          SHA256

          89060ea5f851ebf1c19da4244d3c38b7a89674b1e56c261ee09a650b71d64784

          SHA512

          886b0c2defa8ccb299907207a6f3e7103ae52dfa6f973513efb52801ea097228b04b76001a158f513e7876542ce83bb77c41ca24774e1693692105a1a3da68a2

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2TORU31WFERIQLY17JSN.temp

          Filesize

          9KB

          MD5

          3cdefa393c604cd92db869a3050800f1

          SHA1

          3147a19f5b1ff37534153374fe5e6132bd9ba617

          SHA256

          4dfe3bdf3492c4eaa476c445dea51d3f0e44fb9470cf68a44c103e996db47d4f

          SHA512

          2d8d9cf2801aa7c834b610c614c01333b1ff914597db53f586c7868259fd57b2141974c965bd2d12ea869a2e208e1ba26900a75f1d61bb11f3b2c12134bb0d91

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\eb2cfcf2e80edf70.customDestinations-ms~RFf76f74a.TMP

          Filesize

          9KB

          MD5

          9bf6b7861bc828436fef63057c102183

          SHA1

          14c10e2f8069dbe3bb27c271414174e258e8b83a

          SHA256

          537c6e84db9bc12618e5ab17d89126f1d454051a2098d12d27fac4297fa180c7

          SHA512

          80cacfd21b0dee4121fb5a9d3d82d48bd25429dae744bb73efe12e8b1f9888fc9764a1cd64662de812bce8a25c3b1930eb035892deb84b280617c0cb01125b4b

        • memory/2580-9-0x0000000003ED0000-0x0000000003EE0000-memory.dmp

          Filesize

          64KB

        • memory/2580-40-0x0000000004D20000-0x0000000004D28000-memory.dmp

          Filesize

          32KB

        • memory/2580-5-0x0000000003780000-0x0000000003781000-memory.dmp

          Filesize

          4KB

        • memory/2580-6-0x0000000003790000-0x0000000003791000-memory.dmp

          Filesize

          4KB

        • memory/2580-7-0x00000000037A0000-0x00000000037A1000-memory.dmp

          Filesize

          4KB

        • memory/2580-8-0x00000000037D0000-0x00000000037D1000-memory.dmp

          Filesize

          4KB

        • memory/2580-15-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

          Filesize

          64KB

        • memory/2580-0-0x0000000001350000-0x0000000001351000-memory.dmp

          Filesize

          4KB

        • memory/2580-3-0x0000000003760000-0x0000000003761000-memory.dmp

          Filesize

          4KB

        • memory/2580-4-0x0000000003770000-0x0000000003771000-memory.dmp

          Filesize

          4KB

        • memory/2580-48-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

          Filesize

          4KB

        • memory/2580-54-0x0000000004BC0000-0x0000000004BC8000-memory.dmp

          Filesize

          32KB

        • memory/2580-56-0x0000000004C00000-0x0000000004C01000-memory.dmp

          Filesize

          4KB

        • memory/2580-65-0x0000000004BE0000-0x0000000004BE8000-memory.dmp

          Filesize

          32KB

        • memory/2580-68-0x0000000004D10000-0x0000000004D18000-memory.dmp

          Filesize

          32KB

        • memory/2580-70-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

          Filesize

          4KB

        • memory/2580-75-0x0000000004C00000-0x0000000004C01000-memory.dmp

          Filesize

          4KB

        • memory/2580-131-0x00000000037D0000-0x00000000037D1000-memory.dmp

          Filesize

          4KB

        • memory/2580-2-0x0000000003750000-0x0000000003751000-memory.dmp

          Filesize

          4KB

        • memory/2580-1-0x0000000003740000-0x0000000003741000-memory.dmp

          Filesize

          4KB