ab592e7fb61d45fbe9b26d4b7ec05f60476d83a0ac9b01ba686be741235c5bda

General

Target

2024-07-01_4581a5b52ba5aec2d7c8753e5fc17da3_mafia.exe
Size

1.0MB
MD5

4581a5b52ba5aec2d7c8753e5fc17da3
SHA1

3db8a13bc716e7ce329f3edd22e13b7894fb45fe
SHA256

ab592e7fb61d45fbe9b26d4b7ec05f60476d83a0ac9b01ba686be741235c5bda
SHA512

e7f1dbe8865d58b7be5a44393f512d7b3823a0d4edd4dc8d6922e528a2f8cb06a756b357074fcce646be15597c472e617a4c7ca18c848dba661661ae4167624e
SSDEEP

24576:jaXNJQVJvxC3ZKobLzB/3gQvExFpdhC55AKDqsc53vTglq:hJvCZN7B/gkUrMvLqscVgo

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 9 IoCs

resource	yara_rule
behavioral2/files/0x00080000000232a4-1.dat	UPX
behavioral2/memory/3380-5-0x0000000074860000-0x0000000074A3C000-memory.dmp	UPX
behavioral2/memory/3380-10-0x0000000074860000-0x0000000074A3C000-memory.dmp	UPX
behavioral2/memory/3380-11-0x0000000074860000-0x0000000074A3C000-memory.dmp	UPX
behavioral2/memory/3380-12-0x0000000074860000-0x0000000074A3C000-memory.dmp	UPX
behavioral2/memory/3380-14-0x0000000074860000-0x0000000074A3C000-memory.dmp	UPX
behavioral2/memory/3380-18-0x0000000074860000-0x0000000074A3C000-memory.dmp	UPX
behavioral2/memory/3380-23-0x0000000074860000-0x0000000074A3C000-memory.dmp	UPX
behavioral2/memory/3380-24-0x0000000074860000-0x0000000074A3C000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00080000000232a4-1.dat	acprotect

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2024-07-01_4581a5b52ba5aec2d7c8753e5fc17da3_mafia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2024-07-01_4581a5b52ba5aec2d7c8753e5fc17da3_mafia.exe

Loads dropped DLL 1 IoCs

pid	Process
3380	2024-07-01_4581a5b52ba5aec2d7c8753e5fc17da3_mafia.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00080000000232a4-1.dat	upx
behavioral2/memory/3380-5-0x0000000074860000-0x0000000074A3C000-memory.dmp	upx
behavioral2/memory/3380-10-0x0000000074860000-0x0000000074A3C000-memory.dmp	upx
behavioral2/memory/3380-11-0x0000000074860000-0x0000000074A3C000-memory.dmp	upx
behavioral2/memory/3380-12-0x0000000074860000-0x0000000074A3C000-memory.dmp	upx
behavioral2/memory/3380-14-0x0000000074860000-0x0000000074A3C000-memory.dmp	upx
behavioral2/memory/3380-18-0x0000000074860000-0x0000000074A3C000-memory.dmp	upx
behavioral2/memory/3380-23-0x0000000074860000-0x0000000074A3C000-memory.dmp	upx
behavioral2/memory/3380-24-0x0000000074860000-0x0000000074A3C000-memory.dmp	upx

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2024-07-01_4581a5b52ba5aec2d7c8753e5fc17da3_mafia.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2024-07-01_4581a5b52ba5aec2d7c8753e5fc17da3_mafia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2024-07-01_4581a5b52ba5aec2d7c8753e5fc17da3_mafia.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB	2024-07-01_4581a5b52ba5aec2d7c8753e5fc17da3_mafia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 5c0000000100000004000000001000000b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	2024-07-01_4581a5b52ba5aec2d7c8753e5fc17da3_mafia.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3380	2024-07-01_4581a5b52ba5aec2d7c8753e5fc17da3_mafia.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3380	2024-07-01_4581a5b52ba5aec2d7c8753e5fc17da3_mafia.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-01_4581a5b52ba5aec2d7c8753e5fc17da3_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-01_4581a5b52ba5aec2d7c8753e5fc17da3_mafia.exe"
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HTM4E10.tmp

Filesize
651KB

MD5
a3bc82ec91d572027540f7a796dd95fc

SHA1
f843bac69c6e1b623a4b7810e691834bd4017810

SHA256
cdf24004acda832634a2ca7c656672a5e9de0a6bdf753bd7bee76e87a24f8c07

SHA512
262fe7617daaa2b253e93e3cb80973de4789c76c7247fa8eb0880a6ee6a92c6e3d2e54bf973d38b6943d2277f7875e8327c27e0a6361a80efa74ba84b422c8eb

Download Submit
memory/3380-5-0x0000000074860000-0x0000000074A3C000-memory.dmp

Filesize
1.9MB

Download
memory/3380-6-0x0000000001840000-0x0000000001841000-memory.dmp

Filesize
4KB

Download
memory/3380-10-0x0000000074860000-0x0000000074A3C000-memory.dmp

Filesize
1.9MB

Download
memory/3380-11-0x0000000074860000-0x0000000074A3C000-memory.dmp

Filesize
1.9MB

Download
memory/3380-12-0x0000000074860000-0x0000000074A3C000-memory.dmp

Filesize
1.9MB

Download
memory/3380-14-0x0000000074860000-0x0000000074A3C000-memory.dmp

Filesize
1.9MB

Download
memory/3380-18-0x0000000074860000-0x0000000074A3C000-memory.dmp

Filesize
1.9MB

Download
memory/3380-23-0x0000000074860000-0x0000000074A3C000-memory.dmp

Filesize
1.9MB

Download
memory/3380-24-0x0000000074860000-0x0000000074A3C000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads