Analysis
-
max time kernel
134s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 03:47
Behavioral task
behavioral1
Sample
2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe
Resource
win7-20240215-en
General
-
Target
2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe
-
Size
1.6MB
-
MD5
5fb791968a1460f815e4aba655d4c78d
-
SHA1
38172eadadf048931c71fb511b9fdd7d69f4b818
-
SHA256
4691daa9c9195dd0e1d7dbae90ba6e30a5d9fd506a118967e4796408a6399d69
-
SHA512
a15ff5e215dddb9302ebbf5b8027df7dd20d97194ef2911c543e693c56dac73c3855f987b655367208675f487b30dea944109ef5265013f46b97a8e2761d0bf7
-
SSDEEP
24576:+uOMzTVHxWd7xlr6LbfRRM5OTJ7hIVymFNlMtRVblP9PIjo3rSyp0sUPYud9mj7c:+wod7xULbpf/I07Syp0sUPYu7U2K
Malware Config
Signatures
-
Detect Blackmoon payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3088-10-0x0000000000790000-0x0000000000957000-memory.dmp family_blackmoon behavioral2/memory/3088-8-0x0000000000790000-0x0000000000957000-memory.dmp family_blackmoon behavioral2/memory/3088-11-0x0000000000790000-0x0000000000957000-memory.dmp family_blackmoon behavioral2/memory/3088-13-0x0000000000790000-0x0000000000957000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3088-7-0x0000000002D00000-0x0000000002D18000-memory.dmp UPX behavioral2/memory/3088-10-0x0000000000790000-0x0000000000957000-memory.dmp UPX behavioral2/memory/3088-8-0x0000000000790000-0x0000000000957000-memory.dmp UPX behavioral2/memory/3088-11-0x0000000000790000-0x0000000000957000-memory.dmp UPX behavioral2/memory/3088-13-0x0000000000790000-0x0000000000957000-memory.dmp UPX -
Drops startup file 1 IoCs
Processes:
2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WPS.lnk 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe -
Processes:
resource yara_rule behavioral2/memory/3088-7-0x0000000002D00000-0x0000000002D18000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exepid process 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exedescription pid process Token: SeDebugPrivilege 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe Token: SeLockMemoryPrivilege 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe Token: SeCreateGlobalPrivilege 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe Token: SeBackupPrivilege 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe Token: SeRestorePrivilege 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe Token: SeShutdownPrivilege 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe Token: SeCreateTokenPrivilege 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe Token: SeTakeOwnershipPrivilege 3088 2024-05-23_5fb791968a1460f815e4aba655d4c78d_mafia.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3088-0-0x0000000010000000-0x0000000010109000-memory.dmpFilesize
1.0MB
-
memory/3088-7-0x0000000002D00000-0x0000000002D18000-memory.dmpFilesize
96KB
-
memory/3088-10-0x0000000000790000-0x0000000000957000-memory.dmpFilesize
1.8MB
-
memory/3088-9-0x0000000003560000-0x00000000035B9000-memory.dmpFilesize
356KB
-
memory/3088-8-0x0000000000790000-0x0000000000957000-memory.dmpFilesize
1.8MB
-
memory/3088-6-0x00000000007E3000-0x00000000007E4000-memory.dmpFilesize
4KB
-
memory/3088-11-0x0000000000790000-0x0000000000957000-memory.dmpFilesize
1.8MB
-
memory/3088-13-0x0000000000790000-0x0000000000957000-memory.dmpFilesize
1.8MB