Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 05:53

General

  • Target

    2024-05-29_efe80b610df01e82db5ef1075c37453d_mafia_revil.exe

  • Size

    19.6MB

  • MD5

    efe80b610df01e82db5ef1075c37453d

  • SHA1

    697fba2b9dab221dbeea51d9938bad13ec5d50f3

  • SHA256

    b5981f73c126b02b5b8c94320835712bbfc9bd9aa035d64cf7e3973636d5316b

  • SHA512

    11923ec151a842b99ec4209f44478c0c2ea672bac398ea581cfa7e1c99ff51422797da5e11f007185aa70be73fdaeaae9bd0dd6505c7ae5bc12bd7fe771f8f76

  • SSDEEP

    393216:nJw4Q+EzQk6tJsv6tWKFdu9CKAGkFlUl:JHi6jGOa

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-29_efe80b610df01e82db5ef1075c37453d_mafia_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-29_efe80b610df01e82db5ef1075c37453d_mafia_revil.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:1424

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads