Overview

overview

7

Static

static

3

2024-03-16...py.exe

windows7-x64

7

2024-03-16...py.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-03-2024 05:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-03-16_d5ff4dd8c09d7662bce486eaf1c2c58c_mafia_nionspy.exe

  • Size

    327KB

  • MD5

    d5ff4dd8c09d7662bce486eaf1c2c58c

  • SHA1

    0de2703e122024772318bb9d80aa1d096f683b56

  • SHA256

    34543a08e10f9ba210092b7473d4e83e34b02883b596f6bcc22bcd4524237644

  • SHA512

    73b99cbdbccd9199dbc55b693887172dd6a89d47cdd72cb1eb0751817af5c7a605445bd83345009b26f1e38bb91b0c991a5067db56daef1d0049947107d69169

  • SSDEEP

    6144:i2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:i2TFafJiHCWBWPMjVWrXK0

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-16_d5ff4dd8c09d7662bce486eaf1c2c58c_mafia_nionspy.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-16_d5ff4dd8c09d7662bce486eaf1c2c58c_mafia_nionspy.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:544
    • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\sidebar2.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\sidebar2.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\sidebar2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1492
      • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\sidebar2.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\sidebar2.exe"
        3⤵
        • Executes dropped EXE
        PID:1904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\sidebar2.exe
    Filesize

    327KB

    MD5

    3c658ee9865cd42609b6612e33a34ef9

    SHA1

    a7f72ca0c7e563db6d107e1b9ae9e380836ec23d

    SHA256

    d6afdabb378bb26a18dd1489169e5907a5425c7bc2b8d7841713d47ac1517ea4

    SHA512

    440a699ee5bcdffe8a6a8b19967f08478e9cb2aa32598b04aa94950f716265d68c7638dbc5667ae4dc9ffc2cc30e2d08b84910b10aab31937e4490abbc8f4b2f

    Download Submit