Overview

overview

10

Static

static

10

2024-03-11...ia.exe

windows7-x64

10

2024-03-11...ia.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2024, 03:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-03-11_e9700ee19d13bc5d0bff829cfd9335df_mafia.exe
  • Size 4.0MB
  • Sample240311-ef6b5abd97
  • SHA256 86211b1efe265d6cf39c86d8af98dd99fc0a927dd4465362b0cfc24aa23e86ac
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
upxvmprotect

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Detects executables packed with VMProtect. 3 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:3132
      • C:\Users\Admin\AppData\Local\Temp\rBdGh.exe
        C:\Users\Admin\AppData\Local\Temp\rBdGh.exe
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2896
        • C:\Users\Admin\AppData\Local\Temp\pin.exe
          "C:\Users\Admin\AppData\Local\Temp\pin.exe" "C:\Users\Admin\AppData\Local\Temp\rBdGh.exe" 5386
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5092
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3448
      • C:\Users\Admin\AppData\Local\Temp\2024-03-11_e9700ee19d13bc5d0bff829cfd9335df_mafia.exe
        "C:\Users\Admin\AppData\Local\Temp\2024-03-11_e9700ee19d13bc5d0bff829cfd9335df_mafia.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2840

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          pin.exe
          • Path C:\Users\Admin\AppData\Local\Temp\pin.exe
          • Size 19KB
          • SHA256 a6967e7a3c2251812dd6b3fa0265fb7b61aadc568f562a98c50c345908c6e827
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          rBdGh.exe
          • Path C:\Users\Admin\AppData\Local\Temp\rBdGh.exe
          • Size 283KB
          • SHA256 415046cb084c72a418472d24047e3e4d4da36f8f156813fa12a7f88c3f50daa0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          rBdGh.lnk
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\rBdGh.lnk
          • Size 1KB
          • SHA256 0238ef9517b95fa1dcdf419128ce4eee77a5c41a36d965cad2cdcdd2fc4b2cf4
          • MD5 SHA1 SHA512
          Submit Download

          memory/2840-0-0x0000000000950000-0x0000000000A52000-memory.dmp
          Download

          memory/2840-1-0x0000000000950000-0x0000000000A52000-memory.dmp
          Download

          memory/2840-4-0x0000000000950000-0x0000000000A52000-memory.dmp
          Download

          memory/2896-9-0x0000000000880000-0x000000000092C000-memory.dmp
          Download

          memory/2896-35-0x0000000000880000-0x000000000092C000-memory.dmp
          Download

          memory/2896-36-0x0000000000880000-0x000000000092C000-memory.dmp
          Download

          memory/3448-22-0x0000000000EF0000-0x0000000000EFA000-memory.dmp
          Download

          memory/3448-21-0x0000000000EF0000-0x0000000000EFA000-memory.dmp
          Download

          memory/3448-29-0x0000000000EF0000-0x0000000000EFA000-memory.dmp
          Download