2edb33aae6ab40e40a2d78b900173bff8f71fff18d1588e5a7ff9486d080e96b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Size

5.6MB
MD5

b85381818c9a8643c875edb69896c7d8
SHA1

b36ad47a4b2f5a2e500681e757180a178946361a
SHA256

2edb33aae6ab40e40a2d78b900173bff8f71fff18d1588e5a7ff9486d080e96b
SHA512

060f0031e0641602d1452e28dad0cf6f5fc5d1df1b00130f5b5d906477f6f0785730ebb931966297bc9352d746800f4465a5afebcc4ceb98da883a8b515c50e8
SSDEEP

98304:p6pg+4qaSDRumxkEpMH1FkQmOnhTjqsaUODS4IeOsyrwuv/guB/r:q5IS1FnpAvHZwiO2AOsezgyr

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe

Modifies system certificate store 2 TTPs 28 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\SystemCertificates\TestSignRoot	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\SystemCertificates\TrustedDevices	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\SystemCertificates\FlightRoot	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe

pid	Process
2944	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
2944	2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-29_b85381818c9a8643c875edb69896c7d8_avoslocker_hijackloader_luca-stealer_magniber_revil.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2944