Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
03/09/2023, 15:18
General
-
Target
2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
-
Size
327KB
-
MD5
0d655e5eeb4242b1b82c9f41e8359308
-
SHA1
a231671390775a1560281c3885a8a55b6ea106cd
-
SHA256
4fa9aed3ed51e63919eebf16c07ceb3f6e66e51e356ee3e7d880640b8c8782ca
-
SHA512
fea3d9bf66d0d44235cd42d9cfcac50518f985b5e9263233e298d2c16e2c68059432c64cc900cde7891cc16a48053e3373599ec9f879d2acb7f9a0686fb82603
-
SSDEEP
6144:R2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:R2TFafJiHCWBWPMjVWrXK0
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\sidebar2.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\sidebar2.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\sidebar2.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\sidebar2.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\sidebar2.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
327KB
MD50fd5495517071f9e12ac9a6f2a1689fd
SHA1aac8edb08cdd99ae2ebe69bab512ee6c86843baf
SHA25600e6977af9e23b9f67889dfcf6d5ec3b2b2b7fc0173a303251c6739689c129a0
SHA5128b7a3c0564989b1809a0b6cb69eb402e0e2bb7224d25fee2b39ebcaf168f639eb50eca924a8173ec4e1f73b9877b8e6a17d150305e282d8f940ddce0275e1bde
-
Filesize
327KB
MD50fd5495517071f9e12ac9a6f2a1689fd
SHA1aac8edb08cdd99ae2ebe69bab512ee6c86843baf
SHA25600e6977af9e23b9f67889dfcf6d5ec3b2b2b7fc0173a303251c6739689c129a0
SHA5128b7a3c0564989b1809a0b6cb69eb402e0e2bb7224d25fee2b39ebcaf168f639eb50eca924a8173ec4e1f73b9877b8e6a17d150305e282d8f940ddce0275e1bde
-
Filesize
327KB
MD50fd5495517071f9e12ac9a6f2a1689fd
SHA1aac8edb08cdd99ae2ebe69bab512ee6c86843baf
SHA25600e6977af9e23b9f67889dfcf6d5ec3b2b2b7fc0173a303251c6739689c129a0
SHA5128b7a3c0564989b1809a0b6cb69eb402e0e2bb7224d25fee2b39ebcaf168f639eb50eca924a8173ec4e1f73b9877b8e6a17d150305e282d8f940ddce0275e1bde
-
Filesize
327KB
MD50fd5495517071f9e12ac9a6f2a1689fd
SHA1aac8edb08cdd99ae2ebe69bab512ee6c86843baf
SHA25600e6977af9e23b9f67889dfcf6d5ec3b2b2b7fc0173a303251c6739689c129a0
SHA5128b7a3c0564989b1809a0b6cb69eb402e0e2bb7224d25fee2b39ebcaf168f639eb50eca924a8173ec4e1f73b9877b8e6a17d150305e282d8f940ddce0275e1bde