e6342dfafbfaad1d6f61b15cb812ecd9baccc4f5a8683eb1fcf9e34d8d4dcbd6

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2023 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c18c4aea228a21660828fc131bf4a49b_mafia_JC.exe
Size

15.4MB
MD5

c18c4aea228a21660828fc131bf4a49b
SHA1

cec0c5c0e75040b5255e2936ed5bdcdb1696b364
SHA256

e6342dfafbfaad1d6f61b15cb812ecd9baccc4f5a8683eb1fcf9e34d8d4dcbd6
SHA512

1997e90fbe8ff2bd05c790877ea1d6197b5f624c0c6b0ec7e3d671cbf26a817e95cec8f699238cbf08d3ab1a59dde8b3bb135761ff822c767736073e548db9bf
SSDEEP

393216:fXXZRqSPWhMKIHEXfVNhoo1Zp4EuXEoBAgPiSk5K622Ob3NZ:fXZtehMnKn54h0oBAgPiSsKKOzNZ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe

pid process

1900 c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe

Loads dropped DLL 12 IoCs

Processes:

c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe

pid	process
1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe

pid	process
1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe

pid process

1900 c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c18c4aea228a21660828fc131bf4a49b_mafia_JC.exec18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe

description	pid	process	target process
PID 3068 wrote to memory of 1900	3068	c18c4aea228a21660828fc131bf4a49b_mafia_JC.exe	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
PID 3068 wrote to memory of 1900	3068	c18c4aea228a21660828fc131bf4a49b_mafia_JC.exe	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
PID 3068 wrote to memory of 1900	3068	c18c4aea228a21660828fc131bf4a49b_mafia_JC.exe	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
PID 1900 wrote to memory of 3988	1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe	EVENTCREATE.EXE
PID 1900 wrote to memory of 3988	1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe	EVENTCREATE.EXE
PID 1900 wrote to memory of 3988	1900	c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe	EVENTCREATE.EXE

C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
"C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe" /pi="C:\Users\Admin\AppData\Local\Temp\InstallerParams_f6dc31f2-3de2-4a13-8fce-80c211665ae2.json" /pic="C:\Users\Admin\AppData\Local\Temp\picture_d4cb7b43-e0e4-489f-bace-04b55261cbcd.bmp" /ico="C:\Users\Admin\AppData\Local\Temp\ico_a1d1ebeb-29f0-4871-8048-2213454c2da9.ico"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\EVENTCREATE.EXE
"C:\Windows\system32\EVENTCREATE.EXE" /T INFORMATION /L APPLICATION /ID 100 /SO "MSP360 RMM Agent installer" /D "Begin installation."
3⤵
PID:3988

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallerParams_f6dc31f2-3de2-4a13-8fce-80c211665ae2.json
Filesize
257B

MD5
b9485df57ad6628151b9690d21e08237

SHA1
a88af43087e23152ee5c2040c7ef2dceb89e2d33

SHA256
8d19fce7d35b0ccb7fd58da5851ce55d1aa9bd891ed5f43e2dd26162027e79c9

SHA512
b14bf000f8330e21b35d1cbc916dc56b4a355542a957e9e82eeed94e12c66b0d53be93c50be3a81bfe1cec011fd500c03e911eee56db1eee4b8e8ac87c9ca4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
Filesize
14.9MB

MD5
0c87fc0920b1bebd64b94ff336265e5d

SHA1
ed302a63b65d6042f1d051e4af2e8febf576ff6b

SHA256
d547ff8926abb24eb6d82b3adc9764ead7a9fae5542d0ba9857909a90183c17b

SHA512
269d3ed2d046882fd96411101f9291e015d8a1a2924d96e0a8534c5836bbff235dd19cd8893d08041c69c85d630f1b55ed19a63ae6eee6974a06a606cde40d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\c18c4aea228a21660828fc131bf4a49b_mafia_JC_98fc8cfc-c7da-4c9c-800a-e418452b97e5.exe
Filesize
14.9MB

MD5
0c87fc0920b1bebd64b94ff336265e5d

SHA1
ed302a63b65d6042f1d051e4af2e8febf576ff6b

SHA256
d547ff8926abb24eb6d82b3adc9764ead7a9fae5542d0ba9857909a90183c17b

SHA512
269d3ed2d046882fd96411101f9291e015d8a1a2924d96e0a8534c5836bbff235dd19cd8893d08041c69c85d630f1b55ed19a63ae6eee6974a06a606cde40d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\InstallOptions.dll
Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\InstallOptions.dll
Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\InstallOptions.dll
Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\System.dll
Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\System.dll
Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\System.dll
Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\UAC.dll
Filesize
17KB

MD5
88ad3fd90fc52ac3ee0441a38400a384

SHA1
08bc9e1f5951b54126b5c3c769e3eaed42f3d10b

SHA256
e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42

SHA512
359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\UAC.dll
Filesize
17KB

MD5
88ad3fd90fc52ac3ee0441a38400a384

SHA1
08bc9e1f5951b54126b5c3c769e3eaed42f3d10b

SHA256
e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42

SHA512
359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\UAC.dll
Filesize
17KB

MD5
88ad3fd90fc52ac3ee0441a38400a384

SHA1
08bc9e1f5951b54126b5c3c769e3eaed42f3d10b

SHA256
e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42

SHA512
359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\ioSpecial.ini
Filesize
404B

MD5
0b3a4bc7af8540f48780f23aad14e89a

SHA1
7959a19086686cee5100ca84259b61b2ecc598c8

SHA256
29151789d5316dcaf0a10f0fa99f289832762b4bc6c439ddad7840b781ab59d8

SHA512
0a2835c4f336ce1bb61e3ae8c7ceb4e6a8ba6c7444b46661decf9b3bb9b1e76924ef63c36147407aa3bf327d475b4233c787d519be42f4fb1283c10d9a065a74

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\ioSpecial.ini
Filesize
698B

MD5
b40de44a4278777da45056f62fc8eeff

SHA1
d6dbdbdd80d4b5aa3dfdbd900a05553c0c09f7af

SHA256
6a05c8b33024e0d6fcc616057ae1014cb3a23c78256199fd1802d5508296fbcd

SHA512
4daa54a533087d90286e3337938b73d3397ab2d7b7ecc19641fc86fbdf86c37b977d828d1486f4c390487eaa3ec9a842c878fd3fda8ff0035bc3be3ffe9810ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\nsArray.dll
Filesize
12KB

MD5
0917ee492308b691326e6581e8c793c9

SHA1
ff689c8051ffca7657461ac828bc46e303ab8e59

SHA256
81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f

SHA512
2a4ae4b93b0eac113a0e65f459798466120f1af4605a82a11f9022d790fe0b4f7d368b312f8a073b1dcfe8760e529ea56a5b5d4289321dc9f2fc8a22691b42b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\nsExec.dll
Filesize
6KB

MD5
428c3a07fba184367a5085e46e4a790b

SHA1
f2de6cd4ec99ab784d18914a21de9d919a450089

SHA256
3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55

SHA512
b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\nsExec.dll
Filesize
6KB

MD5
428c3a07fba184367a5085e46e4a790b

SHA1
f2de6cd4ec99ab784d18914a21de9d919a450089

SHA256
3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55

SHA512
b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\nsExec.dll
Filesize
6KB

MD5
428c3a07fba184367a5085e46e4a790b

SHA1
f2de6cd4ec99ab784d18914a21de9d919a450089

SHA256
3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55

SHA512
b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\nsJSON.dll
Filesize
21KB

MD5
b7878c46c342f851d35fb2dbc898a593

SHA1
dd0ebd231edcfdc0a561cbda733c58e22ce3156f

SHA256
15b527ac5d224b2b684ef07fecd6d71d61f05955e3a2bd3dd1de6378e927b3f8

SHA512
d7f179d33695b62da5fc0643fac461129975e78a8694c02e8c8d74471d0ee4061b92f1010401209605146861b259d34079583b2080c8ba69382c2122d9b969c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\processwork.dll
Filesize
231KB

MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\processwork.dll
Filesize
231KB

MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoD041.tmp\processwork.dll
Filesize
231KB

MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
C:\Users\Admin\AppData\Local\Temp\picture_d4cb7b43-e0e4-489f-bace-04b55261cbcd.bmp
Filesize
150KB

MD5
98aca846c2f9d4569cf3746159cf881e

SHA1
d088cf3e48c53d61aa792e90387c9bc50a85ee11

SHA256
fbec5dfc6532218c49374ee1607058acd72c0c9d4418fe5e60f0b7935d0d6eab

SHA512
780e277ca2eb71aaf9b9928df7662510f60714291507335664cdfcb642ab096d479f7a5175256d91a3635011bceea11962a6a047aacfebade1281b1e578a9035

Download Submit
memory/1900-47-0x0000000002910000-0x0000000002951000-memory.dmp

Filesize
260KB

Download