Overview

overview

7

Static

static

3

2024-05-30...ia.exe

windows7-x64

7

2024-05-30...ia.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2024 11:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-30_364a5f2c0fe182076123d0fd29c99274_mafia.exe

  • Size

    1.3MB

  • MD5

    364a5f2c0fe182076123d0fd29c99274

  • SHA1

    8f21a28e0c3bb8dd3784be5ac557b031288727e4

  • SHA256

    4db6cf843b4c65e7a3e7c87918c74c1565d6fb346e132b02a95435d568d60328

  • SHA512

    31028d32bce5504ac0adaf6880935bf308773bb98d2ebbc3adfc551d4a024657bbb406986204432cadcc00c371df85fd80ea7f85d85e6d33e79a8acbc8090aac

  • SSDEEP

    12288:q60B8l6jaOC4owiDhTFjpK0GMFgRnAkZFHANU+:q6FnOCsiDjpFGMeRXFn+

Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-30_364a5f2c0fe182076123d0fd29c99274_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-30_364a5f2c0fe182076123d0fd29c99274_mafia.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3224
  • C:\Windows\SysWOW64\cpllsa.exe
    C:\Windows\SysWOW64\cpllsa.exe m3i
    1⤵
    • Executes dropped EXE
    PID:3940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Documents\ntuser{728F6F2D-5621-4906-771D-FFFFFFFF80156501}.regist
    Filesize

    4B

    MD5

    59babb838a876914f6b5402512da3d41

    SHA1

    eb72a9af96d374bc1d0045513ae1f4541060a7e5

    SHA256

    443c07a2c83b7b0253a325d2b72ac757c3aa5b41cd749842bc74fb3ee9b26866

    SHA512

    6c7f7fd694df9949b4716d009242b423216aa52e579414505406d6d3fcaa84fd8c9227e55eb80d28ba40068d80fd6f8be089f2b655ebc72872cd226236fa97ea

    Download Submit

  • C:\Windows\SysWOW64\cpllsa.exe
    Filesize

    1.3MB

    MD5

    364a5f2c0fe182076123d0fd29c99274

    SHA1

    8f21a28e0c3bb8dd3784be5ac557b031288727e4

    SHA256

    4db6cf843b4c65e7a3e7c87918c74c1565d6fb346e132b02a95435d568d60328

    SHA512

    31028d32bce5504ac0adaf6880935bf308773bb98d2ebbc3adfc551d4a024657bbb406986204432cadcc00c371df85fd80ea7f85d85e6d33e79a8acbc8090aac

    Download Submit

  • memory/3224-0-0x0000000000400000-0x0000000000437000-memory.dmp

    Filesize

    220KB

    Download

  • memory/3224-1-0x0000000000400000-0x00000000004FA000-memory.dmp

    Filesize

    1000KB

    Download

  • memory/3224-2-0x0000000000400000-0x00000000004FA000-memory.dmp

    Filesize

    1000KB

    Download

  • memory/3224-8-0x0000000000400000-0x00000000004FA000-memory.dmp

    Filesize

    1000KB

    Download

  • memory/3224-9-0x0000000000400000-0x0000000000437000-memory.dmp

    Filesize

    220KB

    Download

  • memory/3224-10-0x0000000000400000-0x00000000004FA000-memory.dmp

    Filesize

    1000KB

    Download

  • memory/3224-35-0x0000000000400000-0x00000000004FA000-memory.dmp

    Filesize

    1000KB

    Download

  • memory/3224-36-0x0000000000400000-0x00000000004FA000-memory.dmp

    Filesize

    1000KB

    Download

  • memory/3224-50-0x0000000000400000-0x00000000004FA000-memory.dmp

    Filesize

    1000KB

    Download