9434fef31690ac730709f43123379bb08379571594c4945c347b67fb7d4074e4

General

Target

2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe
Size

2.2MB
MD5

ce5fe17d60ca62674bc1c67e5bca520a
SHA1

e373cde00b6284eda501dab9f7b89fea3fa58105
SHA256

9434fef31690ac730709f43123379bb08379571594c4945c347b67fb7d4074e4
SHA512

c23d22016688cc12a9357031bc400cd13aca02b81d1b65c2913e508c546703b3c95f337a3c27395e292248db4021e22027d0846f12ce7a4dcbc9ba21338b2335
SSDEEP

49152:hTEFVxVbtrlYI9xq0oL4nnWKEtStHbPC6SAExuYJ8NGBKCUTjxLdTp4JCF:mVbtrKI9xFo0nPEWC3VxuYWGMF6

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\877FED6D935B7C09CB9E7109447A19B1AC840343	2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\877FED6D935B7C09CB9E7109447A19B1AC840343\Blob = 030000000100000014000000877fed6d935b7c09cb9e7109447a19b1ac8403431400000001000000140000007ba3fafff5d5095d1ef92aff8553edaf47a8d77a0400000001000000100000009e26d79a604eb5c4129b6d650c729db30f0000000100000020000000eb9c685a2a981376b9eeec28fea64d33ffd1d8bcee7259e3d4d398bc7aed398519000000010000001000000019e9d9a841bd185b1fa78b3cbc196bd05c0000000100000004000000000800001800000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000100500003082050c308203f4a0030201020210051f0c7eddc88dbaf00c50e285f42265300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3230303331333132303034385a170d3330303331333132303034385a3050310b300906035504061302555331153013060355040a130c446967694365727420496e63312a30280603550403132144696769436572742053656375726520536974652050726f20434e20434120473330820122300d06092a864886f70d01010105000382010f003082010a0282010100ba83ead5dbcc8a5160dce8ce72db1f0cfe72175baee05027cd3f1aa75595dff1b48be2db2204d1a3d9fdac160fbc9cdf9de95fd78dcac0ad60cafeb8b96a1f1494dc380c87e1dd646df06a6fab19b3b623a979b63c4928fe414b2b06a319cbd999ce34a4e20cebb944be49ac3df947ae30e85586171f83b0a5bf7b75a747cd0d0c7f89585173c22fdbcc71611c9ea0b1a780896a8cba70b2c5b7a3b479cf7260ececc71ad1df2d6fbbeab3c29b1f012330c4df13c94b1982f6ac7cb7abfb927cc5268a7ae3af84d3815a078618c0040d32e5fd0517c4b848d04307d19b52b4e82f89ee5fd02db82eb98febbf710e88fd3d5377292ce6c7912a215a982b4cc68d0203010001a38201cf308201cb301d0603551d0e041604147ba3fafff5d5095d1ef92aff8553edaf47a8d77a301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b0601050507030230120603551d130101ff040830060101ff020100303306082b0601050507010104273025302306082b060105050730018617687474703a2f2f6f6373702e64696769636572742e636e30400603551d1f043930373035a033a031862f687474703a2f2f63726c2e64696769636572742e636e2f4469676943657274476c6f62616c526f6f7443412e63726c3081ce0603551d200481c63081c33081c00604551d20003081b7302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f43505330818a06082b06010505070202307e0c7c416e7920757365206f66207468697320436572746966696361746520636f6e737469747574657320616363657074616e6365206f66207468652052656c79696e672050617274792041677265656d656e74206c6f63617465642061742068747470733a2f2f7777772e64696769636572742e636f6d2f7270612d7561300d06092a864886f70d01010b050003820101008530fe84c6ce2ec0120b955df208e835f53d068726355c52c72641bfce062676815973837423b348b8c28466471a39cd775ade90912e86a4c3b76999176137e5f73a43b7076a4a92f8de7902c5dfa7c41d40dcdfbd0ff66cc283947818b4148fdf84a4e1e01f2c751a1505844912179fe49d0b46cb17ad24626319884dd5f6376cc27082faff5ed85ddb36053c6f7c21c35865a79c0cace22d16e5c7204396ed9cf1d55b78446423bd9dbac03a5e2cc1dc854d5d50d14506ff065161912414a7697c13a30960c3acaa35486575432b3ceb2f7af8082a6c307dd66767c48af532e4ed1c69ff435604db1f4e4936f67f693402b845c4575c8ca4df2cb7b01b5c43	2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\877FED6D935B7C09CB9E7109447A19B1AC840343\Blob = 4b0000000100000044000000330046004500320042004400300031004100420036004200430033003100320042004600300044004100440045003700460037003900370033003800380046005f0000001800000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee5c00000001000000040000000008000019000000010000001000000019e9d9a841bd185b1fa78b3cbc196bd00f0000000100000020000000eb9c685a2a981376b9eeec28fea64d33ffd1d8bcee7259e3d4d398bc7aed39850400000001000000100000009e26d79a604eb5c4129b6d650c729db31400000001000000140000007ba3fafff5d5095d1ef92aff8553edaf47a8d77a030000000100000014000000877fed6d935b7c09cb9e7109447a19b1ac8403432000000001000000100500003082050c308203f4a0030201020210051f0c7eddc88dbaf00c50e285f42265300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3230303331333132303034385a170d3330303331333132303034385a3050310b300906035504061302555331153013060355040a130c446967694365727420496e63312a30280603550403132144696769436572742053656375726520536974652050726f20434e20434120473330820122300d06092a864886f70d01010105000382010f003082010a0282010100ba83ead5dbcc8a5160dce8ce72db1f0cfe72175baee05027cd3f1aa75595dff1b48be2db2204d1a3d9fdac160fbc9cdf9de95fd78dcac0ad60cafeb8b96a1f1494dc380c87e1dd646df06a6fab19b3b623a979b63c4928fe414b2b06a319cbd999ce34a4e20cebb944be49ac3df947ae30e85586171f83b0a5bf7b75a747cd0d0c7f89585173c22fdbcc71611c9ea0b1a780896a8cba70b2c5b7a3b479cf7260ececc71ad1df2d6fbbeab3c29b1f012330c4df13c94b1982f6ac7cb7abfb927cc5268a7ae3af84d3815a078618c0040d32e5fd0517c4b848d04307d19b52b4e82f89ee5fd02db82eb98febbf710e88fd3d5377292ce6c7912a215a982b4cc68d0203010001a38201cf308201cb301d0603551d0e041604147ba3fafff5d5095d1ef92aff8553edaf47a8d77a301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b0601050507030230120603551d130101ff040830060101ff020100303306082b0601050507010104273025302306082b060105050730018617687474703a2f2f6f6373702e64696769636572742e636e30400603551d1f043930373035a033a031862f687474703a2f2f63726c2e64696769636572742e636e2f4469676943657274476c6f62616c526f6f7443412e63726c3081ce0603551d200481c63081c33081c00604551d20003081b7302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f43505330818a06082b06010505070202307e0c7c416e7920757365206f66207468697320436572746966696361746520636f6e737469747574657320616363657074616e6365206f66207468652052656c79696e672050617274792041677265656d656e74206c6f63617465642061742068747470733a2f2f7777772e64696769636572742e636f6d2f7270612d7561300d06092a864886f70d01010b050003820101008530fe84c6ce2ec0120b955df208e835f53d068726355c52c72641bfce062676815973837423b348b8c28466471a39cd775ade90912e86a4c3b76999176137e5f73a43b7076a4a92f8de7902c5dfa7c41d40dcdfbd0ff66cc283947818b4148fdf84a4e1e01f2c751a1505844912179fe49d0b46cb17ad24626319884dd5f6376cc27082faff5ed85ddb36053c6f7c21c35865a79c0cace22d16e5c7204396ed9cf1d55b78446423bd9dbac03a5e2cc1dc854d5d50d14506ff065161912414a7697c13a30960c3acaa35486575432b3ceb2f7af8082a6c307dd66767c48af532e4ed1c69ff435604db1f4e4936f67f693402b845c4575c8ca4df2cb7b01b5c43	2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1592	2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe
1592	2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 1592	3256	2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe	84
PID 3256 wrote to memory of 1592	3256	2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe	84
PID 3256 wrote to memory of 1592	3256	2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Users\Admin\AppData\Local\Temp\2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-08-25_ce5fe17d60ca62674bc1c67e5bca520a_mafia.exe" /postdata
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2013091800465752388781aaecd.jpg

Filesize
729B

MD5
c7a76e0654ab9562e4c3ca3d7589a7ca

SHA1
8f94f9ac2e92335a6abff669d41ed50a7986865e

SHA256
09018489990b9d265f4bef40a5abaf2cb451a48a30e5fec0a5c5c336d65434cf

SHA512
0e8c641b195cffe9d80f2cc3e9ef81e5ed7bdb7a5681b99d7066ba1ce96172de00a6581604e75be31275f6f9eac0cb1ffd113085b3bff3b96746ed688d1bc798

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads