4dfd72841c31b234bc6a2710d3efc6b158ff3c02542ada2de72aec9a2e818aeb

General

Target

2024-04-17_2a82eb9fecafa0148d609dbc1e31cbf2_karagany_mafia.exe
Size

194KB
MD5

2a82eb9fecafa0148d609dbc1e31cbf2
SHA1

eb1d75214f6bdbd13eaada2bf1aa94215ef57efe
SHA256

4dfd72841c31b234bc6a2710d3efc6b158ff3c02542ada2de72aec9a2e818aeb
SHA512

03f20a28f093e583027681b6f78161f6df39422a2644d386a0ba4aacc093762fc0cc274357075220ba2feb376f3510cd39a39a59c178bcfd60afc80ecead35cc
SSDEEP

3072:cTsPZpEiVR1s4zxxT4uCx2bDpsWutoKxgW6J7gyksi:ZZpvR1s4zGx2koK6W6RgrZ

Score

9^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 8 IoCs

resource	yara_rule
behavioral1/memory/2956-3-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/3040-14-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/3040-17-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/3040-20-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/3040-22-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/3040-25-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/3040-28-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/3040-30-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 8 IoCs

resource	yara_rule
behavioral1/memory/2956-3-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3040-14-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3040-17-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3040-20-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3040-22-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3040-25-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3040-28-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3040-30-0x0000000000400000-0x0000000000C26000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Executes dropped EXE 1 IoCs

pid	Process
3040	winmgr.exe

Loads dropped DLL 1 IoCs

pid	Process
2956	2024-04-17_2a82eb9fecafa0148d609dbc1e31cbf2_karagany_mafia.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Pack: 38033 = "C:\\Windows\\M-5050572907503026835026350826305\\winmgr.exe"	2024-04-17_2a82eb9fecafa0148d609dbc1e31cbf2_karagany_mafia.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Pack: 38033 = "C:\\Windows\\M-5050572907503026835026350826305\\winmgr.exe"	2024-04-17_2a82eb9fecafa0148d609dbc1e31cbf2_karagany_mafia.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\M-5050572907503026835026350826305\winmgr.exe	2024-04-17_2a82eb9fecafa0148d609dbc1e31cbf2_karagany_mafia.exe
File opened for modification	C:\Windows\M-5050572907503026835026350826305\winmgr.exe	2024-04-17_2a82eb9fecafa0148d609dbc1e31cbf2_karagany_mafia.exe
File opened for modification	C:\Windows\M-5050572907503026835026350826305	2024-04-17_2a82eb9fecafa0148d609dbc1e31cbf2_karagany_mafia.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3040	2956	2024-04-17_2a82eb9fecafa0148d609dbc1e31cbf2_karagany_mafia.exe	28
PID 2956 wrote to memory of 3040	2956	2024-04-17_2a82eb9fecafa0148d609dbc1e31cbf2_karagany_mafia.exe	28
PID 2956 wrote to memory of 3040	2956	2024-04-17_2a82eb9fecafa0148d609dbc1e31cbf2_karagany_mafia.exe	28
PID 2956 wrote to memory of 3040	2956	2024-04-17_2a82eb9fecafa0148d609dbc1e31cbf2_karagany_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-17_2a82eb9fecafa0148d609dbc1e31cbf2_karagany_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-17_2a82eb9fecafa0148d609dbc1e31cbf2_karagany_mafia.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\M-5050572907503026835026350826305\winmgr.exe
  C:\Windows\M-5050572907503026835026350826305\winmgr.exe
  2⤵
  - Executes dropped EXE
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\M-5050572907503026835026350826305\winmgr.exe

Filesize
194KB

MD5
2a82eb9fecafa0148d609dbc1e31cbf2

SHA1
eb1d75214f6bdbd13eaada2bf1aa94215ef57efe

SHA256
4dfd72841c31b234bc6a2710d3efc6b158ff3c02542ada2de72aec9a2e818aeb

SHA512
03f20a28f093e583027681b6f78161f6df39422a2644d386a0ba4aacc093762fc0cc274357075220ba2feb376f3510cd39a39a59c178bcfd60afc80ecead35cc

Download Submit
memory/2956-0-0x0000000000400000-0x0000000000C26000-memory.dmp

Filesize
8.1MB

Download
memory/2956-2-0x0000000000CA0000-0x0000000000DA0000-memory.dmp

Filesize
1024KB

Download
memory/2956-3-0x0000000000400000-0x0000000000C26000-memory.dmp

Filesize
8.1MB

Download
memory/2956-10-0x0000000002920000-0x0000000003146000-memory.dmp

Filesize
8.1MB

Download
memory/3040-13-0x0000000000DC0000-0x0000000000EC0000-memory.dmp

Filesize
1024KB

Download
memory/3040-11-0x0000000000400000-0x0000000000C26000-memory.dmp

Filesize
8.1MB

Download
memory/3040-14-0x0000000000400000-0x0000000000C26000-memory.dmp

Filesize
8.1MB

Download
memory/3040-17-0x0000000000400000-0x0000000000C26000-memory.dmp

Filesize
8.1MB

Download
memory/3040-19-0x0000000000DC0000-0x0000000000EC0000-memory.dmp

Filesize
1024KB

Download
memory/3040-20-0x0000000000400000-0x0000000000C26000-memory.dmp

Filesize
8.1MB

Download
memory/3040-22-0x0000000000400000-0x0000000000C26000-memory.dmp

Filesize
8.1MB

Download
memory/3040-25-0x0000000000400000-0x0000000000C26000-memory.dmp

Filesize
8.1MB

Download
memory/3040-28-0x0000000000400000-0x0000000000C26000-memory.dmp

Filesize
8.1MB

Download
memory/3040-30-0x0000000000400000-0x0000000000C26000-memory.dmp

Filesize
8.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads