1ddab4dbd1285bc4dcc37c758c71e3fdf2d81790a4f5356050942170beef074e

General

Target

2024-04-30_345a809ce9c1818645302a89065ff883_mafia.exe
Size

1.1MB
MD5

345a809ce9c1818645302a89065ff883
SHA1

464a94f2ee302d20ce5e86e18d64a69640932524
SHA256

1ddab4dbd1285bc4dcc37c758c71e3fdf2d81790a4f5356050942170beef074e
SHA512

29c50f3cd7f7ad36ba0782b5b5506e9160eaada98e6a662e46956dad0effb5fa8c67dac604e10add26fb85efe18689afe24ec93c4219750762334ed5c1d903df
SSDEEP

24576:oKoBPMgHVnkYV0ZD2ovobLzB/3gQvExFpdhC55AKDqsc53vT3v7vJiHq:oj/HVnWZK7B/gkUrMvLqscV3v7vcq

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 8 IoCs

resource	yara_rule
behavioral1/memory/2932-3-0x00000000744C0000-0x000000007469C000-memory.dmp	UPX
behavioral1/memory/2932-42-0x00000000744C0000-0x000000007469C000-memory.dmp	UPX
behavioral1/memory/2932-43-0x00000000744C0000-0x000000007469C000-memory.dmp	UPX
behavioral1/memory/2932-44-0x00000000744C0000-0x000000007469C000-memory.dmp	UPX
behavioral1/memory/2932-46-0x00000000744C0000-0x000000007469C000-memory.dmp	UPX
behavioral1/memory/2932-49-0x00000000744C0000-0x000000007469C000-memory.dmp	UPX
behavioral1/memory/2932-50-0x00000000744C0000-0x000000007469C000-memory.dmp	UPX
behavioral1/memory/2932-54-0x00000000744C0000-0x000000007469C000-memory.dmp	UPX

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2024-04-30_345a809ce9c1818645302a89065ff883_mafia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2024-04-30_345a809ce9c1818645302a89065ff883_mafia.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2932-3-0x00000000744C0000-0x000000007469C000-memory.dmp	upx
behavioral1/memory/2932-42-0x00000000744C0000-0x000000007469C000-memory.dmp	upx
behavioral1/memory/2932-43-0x00000000744C0000-0x000000007469C000-memory.dmp	upx
behavioral1/memory/2932-44-0x00000000744C0000-0x000000007469C000-memory.dmp	upx
behavioral1/memory/2932-46-0x00000000744C0000-0x000000007469C000-memory.dmp	upx
behavioral1/memory/2932-49-0x00000000744C0000-0x000000007469C000-memory.dmp	upx
behavioral1/memory/2932-50-0x00000000744C0000-0x000000007469C000-memory.dmp	upx
behavioral1/memory/2932-54-0x00000000744C0000-0x000000007469C000-memory.dmp	upx

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2024-04-30_345a809ce9c1818645302a89065ff883_mafia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2024-04-30_345a809ce9c1818645302a89065ff883_mafia.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2024-04-30_345a809ce9c1818645302a89065ff883_mafia.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 0f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703091400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded31d000000010000001000000096f98b6e79a74810ce7d398a82f977780b000000010000000e000000430065007200740075006d0000000300000001000000140000006252dc40f71143a22fde9ef7348e064251b181182000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	2024-04-30_345a809ce9c1818645302a89065ff883_mafia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 1900000001000000100000000b6cd9778e41ad67fd6be0a6903710440300000001000000140000006252dc40f71143a22fde9ef7348e064251b181180b000000010000000e000000430065007200740075006d0000001d000000010000001000000096f98b6e79a74810ce7d398a82f977781400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded309000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad2000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	2024-04-30_345a809ce9c1818645302a89065ff883_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118	2024-04-30_345a809ce9c1818645302a89065ff883_mafia.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	2024-04-30_345a809ce9c1818645302a89065ff883_mafia.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2932	2024-04-30_345a809ce9c1818645302a89065ff883_mafia.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-30_345a809ce9c1818645302a89065ff883_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-30_345a809ce9c1818645302a89065ff883_mafia.exe"
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab1BFC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DB4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/2932-3-0x00000000744C0000-0x000000007469C000-memory.dmp

Filesize
1.9MB

Download
memory/2932-4-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2932-42-0x00000000744C0000-0x000000007469C000-memory.dmp

Filesize
1.9MB

Download
memory/2932-43-0x00000000744C0000-0x000000007469C000-memory.dmp

Filesize
1.9MB

Download
memory/2932-44-0x00000000744C0000-0x000000007469C000-memory.dmp

Filesize
1.9MB

Download
memory/2932-46-0x00000000744C0000-0x000000007469C000-memory.dmp

Filesize
1.9MB

Download
memory/2932-49-0x00000000744C0000-0x000000007469C000-memory.dmp

Filesize
1.9MB

Download
memory/2932-50-0x00000000744C0000-0x000000007469C000-memory.dmp

Filesize
1.9MB

Download
memory/2932-54-0x00000000744C0000-0x000000007469C000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads