Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
23/10/2023, 18:47
General
-
Target
NEAS.2023-09-06_ce1569b5b9d07b3a2ac846850c0e0503_mafia_nionspy_JC.exe
-
Size
274KB
-
MD5
ce1569b5b9d07b3a2ac846850c0e0503
-
SHA1
bb3ca5ba1724a5d2333baf65245a44bf40d5a9f3
-
SHA256
1d84cc2646e3906369f1f63ffd52e35b4bebdb074fadba9dcea8174aa3aed17b
-
SHA512
0c59c2980d8aa372f06323528c554bb738cc040d07d2243b4cb26fbbc3b45fbb0453057646a4a855fb6b39b53ebae75c8eb5e4a5c7454f3fdf9c606cc2c76dd4
-
SSDEEP
6144:2YvZ6brUj+bvqHXSpWr2Kqz83Oad3Jg4PlPDIQ+KLzDDg:2YvEbrUjp3SpWggd3JBPlPDIQ3g
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_ce1569b5b9d07b3a2ac846850c0e0503_mafia_nionspy_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_ce1569b5b9d07b3a2ac846850c0e0503_mafia_nionspy_JC.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
274KB
MD52e8189b77beefc5bb9d663f15c2c3466
SHA1a45f7f3cae5f95f8a72771f622deeaa82bd4d21f
SHA256b76a8bdc26fd41af2a9e9df02f33936e57dd63fcbf17b90bf38492b1591daa66
SHA51284f83ff389ccdac7b669cea4277dd615b38a800fb165fea4bf4ed91856471de33ddd679c4439266ab3aab0f3723bb141a97db9dcf8e5c2087d5a6360e5130912
-
Filesize
274KB
MD52e8189b77beefc5bb9d663f15c2c3466
SHA1a45f7f3cae5f95f8a72771f622deeaa82bd4d21f
SHA256b76a8bdc26fd41af2a9e9df02f33936e57dd63fcbf17b90bf38492b1591daa66
SHA51284f83ff389ccdac7b669cea4277dd615b38a800fb165fea4bf4ed91856471de33ddd679c4439266ab3aab0f3723bb141a97db9dcf8e5c2087d5a6360e5130912
-
Filesize
274KB
MD52e8189b77beefc5bb9d663f15c2c3466
SHA1a45f7f3cae5f95f8a72771f622deeaa82bd4d21f
SHA256b76a8bdc26fd41af2a9e9df02f33936e57dd63fcbf17b90bf38492b1591daa66
SHA51284f83ff389ccdac7b669cea4277dd615b38a800fb165fea4bf4ed91856471de33ddd679c4439266ab3aab0f3723bb141a97db9dcf8e5c2087d5a6360e5130912
-
Filesize
274KB
MD52e8189b77beefc5bb9d663f15c2c3466
SHA1a45f7f3cae5f95f8a72771f622deeaa82bd4d21f
SHA256b76a8bdc26fd41af2a9e9df02f33936e57dd63fcbf17b90bf38492b1591daa66
SHA51284f83ff389ccdac7b669cea4277dd615b38a800fb165fea4bf4ed91856471de33ddd679c4439266ab3aab0f3723bb141a97db9dcf8e5c2087d5a6360e5130912