Analysis
-
max time kernel
156s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
31-10-2023 16:34
General
-
Target
NEAS.2023-09-08_3bd874975daedb1cc200a741c9e6d768_mafia_nionspy_JC.exe
-
Size
328KB
-
MD5
3bd874975daedb1cc200a741c9e6d768
-
SHA1
3e41c065543caf7d768a9fb33b494acaaf149019
-
SHA256
5bc5ec2c338febf2b97df36aad4fb45b3aff987e071c23d148168888b0f5651e
-
SHA512
ccc4ac8cd50ffd5947f50c897d7531ab1e507aea2409d035435371bda83b05826525e904a5256000634ed7a4e1e1aea2e96a5dd8b02906765f09c5bfff8b7ee8
-
SSDEEP
6144:+2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:+2TFafJiHCWBWPMjVWrXf1v
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_3bd874975daedb1cc200a741c9e6d768_mafia_nionspy_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_3bd874975daedb1cc200a741c9e6d768_mafia_nionspy_JC.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\sidebar2.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\sidebar2.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\sidebar2.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\sidebar2.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\sidebar2.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
328KB
MD568c7d7d227bbf42126478323bba62363
SHA189ef53ad6acedc361a1510b8accd2d3e6dc8b4e0
SHA256f4aa175a27025a5c0b3be0658d54ab0a35c446b0889c35692c6222421eb590e5
SHA51230fe6bd493f7e6482fa85964ba25c03ef9aa6755098a4642ef52c2d9d4b20eafd9103be4095550093ea24bf922ca1c6b92d9b8321a51a67021aa043a47ce2857
-
Filesize
328KB
MD568c7d7d227bbf42126478323bba62363
SHA189ef53ad6acedc361a1510b8accd2d3e6dc8b4e0
SHA256f4aa175a27025a5c0b3be0658d54ab0a35c446b0889c35692c6222421eb590e5
SHA51230fe6bd493f7e6482fa85964ba25c03ef9aa6755098a4642ef52c2d9d4b20eafd9103be4095550093ea24bf922ca1c6b92d9b8321a51a67021aa043a47ce2857
-
Filesize
328KB
MD568c7d7d227bbf42126478323bba62363
SHA189ef53ad6acedc361a1510b8accd2d3e6dc8b4e0
SHA256f4aa175a27025a5c0b3be0658d54ab0a35c446b0889c35692c6222421eb590e5
SHA51230fe6bd493f7e6482fa85964ba25c03ef9aa6755098a4642ef52c2d9d4b20eafd9103be4095550093ea24bf922ca1c6b92d9b8321a51a67021aa043a47ce2857
-
Filesize
328KB
MD568c7d7d227bbf42126478323bba62363
SHA189ef53ad6acedc361a1510b8accd2d3e6dc8b4e0
SHA256f4aa175a27025a5c0b3be0658d54ab0a35c446b0889c35692c6222421eb590e5
SHA51230fe6bd493f7e6482fa85964ba25c03ef9aa6755098a4642ef52c2d9d4b20eafd9103be4095550093ea24bf922ca1c6b92d9b8321a51a67021aa043a47ce2857