e6ce4804c8558d7e16b753b77c6b70c813c8aa0e09edd94b8c1daa48405a82b2

Analysis

max time kernel
132s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Size 344KB
Sample240528-kpdlcsda2t
SHA256 e6ce4804c8558d7e16b753b77c6b70c813c8aa0e09edd94b8c1daa48405a82b2
MD5 49c1103d13de84ed54806eb41f82b0fb
SHA1 06773fea288001c1612669989560c65e298f4bd7
SHA512 e5fe03bb2c75c24e2e633b0febef95a1a199d60d81639ebe9f5dcdb76d7ce61eaf3cf02bdb237f1b9976357ae9b81f081f3e15384141253f1c4ba91e5f2b9464
SSDEEP 6144:pTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:pTBPFV0RyWl3h2E+7pYm0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe

Executes dropped EXE 2 IoCs

pid	Process
3652	SearchIndexerDB.exe
4728	SearchIndexerDB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\cmos\shell	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\cmos\shell\runas\command\ = "\"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\cmos	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\cmos\shell\open	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\cmos\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\SearchIndexerDB.exe\" /START \"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\cmos\shell\runas	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\cmos\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\cmos\shell\open\command	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\cmos\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\.exe\shell\open\command	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\SearchIndexerDB.exe\" /START \"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\cmos\Content-Type = "application/x-msdownload"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\cmos\shell\runas\command	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\.exe\Content-Type = "application/x-msdownload"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\.exe\DefaultIcon	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\cmos\ = "Application"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\cmos\DefaultIcon	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\.exe\ = "cmos"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\.exe\shell	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\.exe\DefaultIcon\ = "%1"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\.exe\shell\open	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\.exe\shell\runas	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\cmos\DefaultIcon\ = "%1"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\.exe	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\.exe\shell\runas\command	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3652	SearchIndexerDB.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3652	5088	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe	82
PID 5088 wrote to memory of 3652	5088	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe	82
PID 5088 wrote to memory of 3652	5088	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe	82
PID 3652 wrote to memory of 4728	3652	SearchIndexerDB.exe	83
PID 3652 wrote to memory of 4728	3652	SearchIndexerDB.exe	83
PID 3652 wrote to memory of 4728	3652	SearchIndexerDB.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe"
    3⤵
    - Executes dropped EXE
    PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SearchIndexerDB.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe
Size 344KB
SHA256 a91e3dab6f97021f76a9f9b018a8e1a442f16126be4987f83d8bacf683828625
MD5 a7603a3c59da1bf50651adfa8f88d351
SHA1 5db0d84d299ace6ff40e94cb3113e44e6cf25018
SHA512 e984c3db4fa33bffc4d72356387fe2cf9d1008aa952a13f622aa48dc884ca3e4bfed2f4541f9703d3838a39e18d2b46540e3b6797f122a95414faebc0239bf17
SSDEEP 6144:qTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:qTBPFV0RyWl3h2E+7pYm0
MD5 SHA1 SHA512 SSDEEP

Submit Download