Analysis
- user interaction
yes - max time kernel
68s - max time network
70s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 14:22
General
- Target MussoliniGrabber.rar
- Size 3.8MB
- Sample260809-rprxbasxav
- SHA256 0ccfeb4caed31f48dfe790eb38327808c241cd3fd5e2abab4cae156ee7e88ae5
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Obfuscated with Agile.Net obfuscator 14 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\MussoliniGrabber.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\MussoliniGrabber\Mussolini.builder.exe"C:\Users\Admin\Desktop\MussoliniGrabber\Mussolini.builder.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Bunifu.Licensing.dll
Bunifu.UI.WinForms.1.5.3.dll
Bunifu.UI.WinForms.BunifuButton.dll
Bunifu.UI.WinForms.BunifuLabel.dll
Bunifu.UI.WinForms.BunifuShadowPanel.dll
Bunifu.UI.WinForms.BunifuTextBox.dll
Bunifu.UI.WinForms.BunifuToggleSwitch.dll
Guna.UI2.dll
Mussolini.builder.exe
memory/2336-96-0x000001F2EC160000-0x000001F2EC180000-memory.dmp
memory/2336-100-0x000001F2ECE10000-0x000001F2ECE6A000-memory.dmp
memory/2336-104-0x000001F2EC180000-0x000001F2EC190000-memory.dmp
memory/2336-94-0x000001F2EC140000-0x000001F2EC160000-memory.dmp
memory/2336-102-0x000001F2ED090000-0x000001F2ED2AC000-memory.dmp
memory/2336-92-0x000001F2EA8C0000-0x000001F2EA8D0000-memory.dmp
memory/2336-106-0x000001F2ED2B0000-0x000001F2ED3FA000-memory.dmp
memory/2336-90-0x000001F2EA4F0000-0x000001F2EA518000-memory.dmp
memory/2336-98-0x000001F2ECDA0000-0x000001F2ECE0E000-memory.dmp
memory/2336-107-0x000001F2ECE70000-0x000001F2ECF86000-memory.dmp
memory/2336-108-0x000001F2ECCF0000-0x000001F2ECD20000-memory.dmp
memory/2336-110-0x000001F2ECD20000-0x000001F2ECD30000-memory.dmp
memory/2336-109-0x000001F2ECAA0000-0x000001F2ECBEE000-memory.dmp