e6342dfafbfaad1d6f61b15cb812ecd9baccc4f5a8683eb1fcf9e34d8d4dcbd6

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
28-08-2023 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c18c4aea228a21660828fc131bf4a49b_mafia_JC.exe
Size

15.4MB
MD5

c18c4aea228a21660828fc131bf4a49b
SHA1

cec0c5c0e75040b5255e2936ed5bdcdb1696b364
SHA256

e6342dfafbfaad1d6f61b15cb812ecd9baccc4f5a8683eb1fcf9e34d8d4dcbd6
SHA512

1997e90fbe8ff2bd05c790877ea1d6197b5f624c0c6b0ec7e3d671cbf26a817e95cec8f699238cbf08d3ab1a59dde8b3bb135761ff822c767736073e548db9bf
SSDEEP

393216:fXXZRqSPWhMKIHEXfVNhoo1Zp4EuXEoBAgPiSk5K622Ob3NZ:fXZtehMnKn54h0oBAgPiSsKKOzNZ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe

pid process

3044 c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe

Loads dropped DLL 9 IoCs

Processes:

c18c4aea228a21660828fc131bf4a49b_mafia_JC.exec18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe

pid	process
1936	c18c4aea228a21660828fc131bf4a49b_mafia_JC.exe
3044	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
3044	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
3044	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
3044	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
3044	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
3044	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
3044	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
3044	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe

pid	process
3044	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
3044	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe

pid process

3044 c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe

pid process

3044 c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c18c4aea228a21660828fc131bf4a49b_mafia_JC.exec18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe

description	pid	process	target process
PID 1936 wrote to memory of 3044	1936	c18c4aea228a21660828fc131bf4a49b_mafia_JC.exe	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
PID 1936 wrote to memory of 3044	1936	c18c4aea228a21660828fc131bf4a49b_mafia_JC.exe	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
PID 1936 wrote to memory of 3044	1936	c18c4aea228a21660828fc131bf4a49b_mafia_JC.exe	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
PID 1936 wrote to memory of 3044	1936	c18c4aea228a21660828fc131bf4a49b_mafia_JC.exe	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
PID 3044 wrote to memory of 2924	3044	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe	EVENTCREATE.EXE
PID 3044 wrote to memory of 2924	3044	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe	EVENTCREATE.EXE
PID 3044 wrote to memory of 2924	3044	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe	EVENTCREATE.EXE
PID 3044 wrote to memory of 2924	3044	c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe	EVENTCREATE.EXE

C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936

C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
"C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe" /pi="C:\Users\Admin\AppData\Local\Temp\InstallerParams_2077197b-0a93-47a3-9580-556398a5b98b.json" /pic="C:\Users\Admin\AppData\Local\Temp\picture_13b0e9c4-5a0a-4092-8bf4-724f1e951eef.bmp" /ico="C:\Users\Admin\AppData\Local\Temp\ico_69cbd444-af7c-4e9f-82c2-e3c9f5cf4673.ico"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3044

C:\Windows\SysWOW64\EVENTCREATE.EXE
"C:\Windows\system32\EVENTCREATE.EXE" /T INFORMATION /L APPLICATION /ID 100 /SO "MSP360 RMM Agent installer" /D "Begin installation."
3⤵
PID:2924

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallerParams_2077197b-0a93-47a3-9580-556398a5b98b.json
Filesize
257B

MD5
b9485df57ad6628151b9690d21e08237

SHA1
a88af43087e23152ee5c2040c7ef2dceb89e2d33

SHA256
8d19fce7d35b0ccb7fd58da5851ce55d1aa9bd891ed5f43e2dd26162027e79c9

SHA512
b14bf000f8330e21b35d1cbc916dc56b4a355542a957e9e82eeed94e12c66b0d53be93c50be3a81bfe1cec011fd500c03e911eee56db1eee4b8e8ac87c9ca4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
Filesize
14.9MB

MD5
0c87fc0920b1bebd64b94ff336265e5d

SHA1
ed302a63b65d6042f1d051e4af2e8febf576ff6b

SHA256
d547ff8926abb24eb6d82b3adc9764ead7a9fae5542d0ba9857909a90183c17b

SHA512
269d3ed2d046882fd96411101f9291e015d8a1a2924d96e0a8534c5836bbff235dd19cd8893d08041c69c85d630f1b55ed19a63ae6eee6974a06a606cde40d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
Filesize
14.9MB

MD5
0c87fc0920b1bebd64b94ff336265e5d

SHA1
ed302a63b65d6042f1d051e4af2e8febf576ff6b

SHA256
d547ff8926abb24eb6d82b3adc9764ead7a9fae5542d0ba9857909a90183c17b

SHA512
269d3ed2d046882fd96411101f9291e015d8a1a2924d96e0a8534c5836bbff235dd19cd8893d08041c69c85d630f1b55ed19a63ae6eee6974a06a606cde40d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy92FD.tmp\System.dll
Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy92FD.tmp\ioSpecial.ini
Filesize
698B

MD5
2504319bcdfba5341fae99a2cc3c992d

SHA1
22478614e1598635b85bc10096ad284783b055bd

SHA256
f46be91351aec5aeb5d72a4fd463fbda871a511314f8fab6dfb96b602c77b656

SHA512
9595ce9f67d4a54e55b33a628cdfa132d4dfa7efd31f318a5f819e1318077eb2520ce5ee1c27140008fbc55c051216c0916b231c8bc54976d60ca091a36113f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy92FD.tmp\ioSpecial.ini
Filesize
737B

MD5
5598ada491baaf2dcffe0703077d9320

SHA1
f47c75708e3a0b24eb9965e417b24da5acc808ea

SHA256
5f5c293f61f934c12da77fde6146c13f257a452390974e388eb54bd8b348b582

SHA512
e5800f83c1cbb45144012da238118f6033908a2f0b86b5881656dc3e518b1327099d3ff44f08f6a6c7f6754bacaccef52f2e0039d44bf2bcd92748e6c2670482

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy92FD.tmp\modern-wizard.bmp
Filesize
150KB

MD5
98aca846c2f9d4569cf3746159cf881e

SHA1
d088cf3e48c53d61aa792e90387c9bc50a85ee11

SHA256
fbec5dfc6532218c49374ee1607058acd72c0c9d4418fe5e60f0b7935d0d6eab

SHA512
780e277ca2eb71aaf9b9928df7662510f60714291507335664cdfcb642ab096d479f7a5175256d91a3635011bceea11962a6a047aacfebade1281b1e578a9035

Download Submit
C:\Users\Admin\AppData\Local\Temp\picture_13b0e9c4-5a0a-4092-8bf4-724f1e951eef.bmp
Filesize
150KB

MD5
98aca846c2f9d4569cf3746159cf881e

SHA1
d088cf3e48c53d61aa792e90387c9bc50a85ee11

SHA256
fbec5dfc6532218c49374ee1607058acd72c0c9d4418fe5e60f0b7935d0d6eab

SHA512
780e277ca2eb71aaf9b9928df7662510f60714291507335664cdfcb642ab096d479f7a5175256d91a3635011bceea11962a6a047aacfebade1281b1e578a9035

Download Submit
\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_7e88d7cd-88e2-4c80-b742-732cc3bb95b2.exe
Filesize
14.9MB

MD5
0c87fc0920b1bebd64b94ff336265e5d

SHA1
ed302a63b65d6042f1d051e4af2e8febf576ff6b

SHA256
d547ff8926abb24eb6d82b3adc9764ead7a9fae5542d0ba9857909a90183c17b

SHA512
269d3ed2d046882fd96411101f9291e015d8a1a2924d96e0a8534c5836bbff235dd19cd8893d08041c69c85d630f1b55ed19a63ae6eee6974a06a606cde40d6e

Download Submit
\Users\Admin\AppData\Local\Temp\nsy92FD.tmp\InstallOptions.dll
Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
\Users\Admin\AppData\Local\Temp\nsy92FD.tmp\System.dll
Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
\Users\Admin\AppData\Local\Temp\nsy92FD.tmp\System.dll
Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
\Users\Admin\AppData\Local\Temp\nsy92FD.tmp\UAC.dll
Filesize
17KB

MD5
88ad3fd90fc52ac3ee0441a38400a384

SHA1
08bc9e1f5951b54126b5c3c769e3eaed42f3d10b

SHA256
e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42

SHA512
359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb

Download Submit
\Users\Admin\AppData\Local\Temp\nsy92FD.tmp\nsArray.dll
Filesize
12KB

MD5
0917ee492308b691326e6581e8c793c9

SHA1
ff689c8051ffca7657461ac828bc46e303ab8e59

SHA256
81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f

SHA512
2a4ae4b93b0eac113a0e65f459798466120f1af4605a82a11f9022d790fe0b4f7d368b312f8a073b1dcfe8760e529ea56a5b5d4289321dc9f2fc8a22691b42b5

Download Submit
\Users\Admin\AppData\Local\Temp\nsy92FD.tmp\nsExec.dll
Filesize
6KB

MD5
428c3a07fba184367a5085e46e4a790b

SHA1
f2de6cd4ec99ab784d18914a21de9d919a450089

SHA256
3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55

SHA512
b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6

Download Submit
\Users\Admin\AppData\Local\Temp\nsy92FD.tmp\nsJSON.dll
Filesize
21KB

MD5
b7878c46c342f851d35fb2dbc898a593

SHA1
dd0ebd231edcfdc0a561cbda733c58e22ce3156f

SHA256
15b527ac5d224b2b684ef07fecd6d71d61f05955e3a2bd3dd1de6378e927b3f8

SHA512
d7f179d33695b62da5fc0643fac461129975e78a8694c02e8c8d74471d0ee4061b92f1010401209605146861b259d34079583b2080c8ba69382c2122d9b969c2

Download Submit
\Users\Admin\AppData\Local\Temp\nsy92FD.tmp\processwork.dll
Filesize
231KB

MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
memory/3044-44-0x00000000004D0000-0x0000000000511000-memory.dmp

Filesize
260KB

Download
memory/3044-58-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/3044-127-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads