Overview

overview

9

Static

static

1

2024-04-25...ia.exe

windows7-x64

9

2024-04-25...ia.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-04-2024 04:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-25_dea21766108bab09b557ef4dadbf3b70_mafia.exe

  • Size

    512KB

  • MD5

    dea21766108bab09b557ef4dadbf3b70

  • SHA1

    9ed8c5e57d8ffff9390fc8fc93de15c82ae77437

  • SHA256

    c1b2f43f8092002c8676ad806fe1b9c25321c80e9aa356c0a33554210287682e

  • SHA512

    9661e99cf3ffce71b926353d7c934e8cad04b7e8c1db40e07c044241904759b14264d9d5b9cff6ef4045fca7bde8fb1a849a5732b73c5bb0ea28522b935758bf

  • SSDEEP

    12288:YMrdRnH5zCeU+qq8PUvkjivx1zDVngsoBjWuF:YMrdRnH5zW+daUcWZxVngjPF

Score
9/10
evasion

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-25_dea21766108bab09b557ef4dadbf3b70_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-25_dea21766108bab09b557ef4dadbf3b70_mafia.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Loads dropped DLL
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Users\Admin\AppData\Local\Temp\n1879\s1879.exe
      "C:\Users\Admin\AppData\Local\Temp\n1879\s1879.exe" ins.exe /e12610452 /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f /v"C:\Users\Admin\AppData\Local\Temp\2024-04-25_dea21766108bab09b557ef4dadbf3b70_mafia.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2352

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\n1879\s1879.exe
    Filesize

    274KB

    MD5

    885f62860e9e29424954695f13af51c7

    SHA1

    be231bfd6d765f9443e5fd371e9d29b1a4d7876c

    SHA256

    cfb319bc74f6c1fa6aa3cf429f7fabf6b056fc5ebfdbe7a40263fe29665dd12c

    SHA512

    0413a5229109b13d5226af789bbb7747d3aadd772a2c39dd41dc0e05352aa89deb6ad83cba53c0f649e56cd6b9aca00fed7986e25184e0d6c9328c3d6c2c54aa

    Download Submit
  • memory/2352-14-0x0000000000430000-0x000000000043A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2352-15-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2352-16-0x0000000001F50000-0x0000000001FD0000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2352-17-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2352-18-0x0000000001F50000-0x0000000001FD0000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2352-19-0x0000000001F50000-0x0000000001FD0000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2352-20-0x0000000001F50000-0x0000000001FD0000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2352-21-0x0000000001F50000-0x0000000001FD0000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2352-22-0x0000000001F50000-0x0000000001FD0000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2352-23-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2352-24-0x0000000001F50000-0x0000000001FD0000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2352-25-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp
    Filesize

    9.6MB

    Download