604a00327f51c387533fdc35242712e8b3cc206022ad1f2a37aed9ce62db2280

Analysis

max time kernel
127s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2023, 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e71ca2ca8c60915b50ad5b8af289675c_mafia_JC.exe
Size

4.8MB
MD5

e71ca2ca8c60915b50ad5b8af289675c
SHA1

675d4d390bd7bbc6d5981f8eccc267fb19fc4876
SHA256

604a00327f51c387533fdc35242712e8b3cc206022ad1f2a37aed9ce62db2280
SHA512

ca1da5f326ebe3fb721768a2208771f69322f9248871dc4cb3f34551171e725e0521b14c9851fc4dccb8b3dbcb00acba34e70a9ad62025c63813764229960a81
SSDEEP

98304:YQiii83RbXcYMoz77AZ0qCEhza8lkn89NA30EjaLpfVeml50SRP1ri2AGd6uxci3:tiii83RbMDhBY8M305RVeEiSRP1gQ6uP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation	e71ca2ca8c60915b50ad5b8af289675c_mafia_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
3532	irsetup.exe

Loads dropped DLL 1 IoCs

pid	Process
3532	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3532	irsetup.exe
3532	irsetup.exe
3532	irsetup.exe
3532	irsetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3532	2236	e71ca2ca8c60915b50ad5b8af289675c_mafia_JC.exe	81
PID 2236 wrote to memory of 3532	2236	e71ca2ca8c60915b50ad5b8af289675c_mafia_JC.exe	81
PID 2236 wrote to memory of 3532	2236	e71ca2ca8c60915b50ad5b8af289675c_mafia_JC.exe	81

C:\Users\Admin\AppData\Local\Temp\e71ca2ca8c60915b50ad5b8af289675c_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\e71ca2ca8c60915b50ad5b8af289675c_mafia_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:4299634 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\e71ca2ca8c60915b50ad5b8af289675c_mafia_JC.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-3195054982-4292022746-1467505928-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
3.6MB

MD5
7a3ea04eb0b932e7ddcbfa7e3ea56758

SHA1
b9875127e3998610175c837607910d58e0ed5b74

SHA256
46571dd8054637f4c5bfbe482e7fa1cb359d8e3289196577c2a63054008be1a4

SHA512
34d569bdf19c0004845ee4cacd8bc351cbbc06a690cce7452062b3a2790f439f3887e60d64678bef3ad46b955eee32f3bbac88f612068b558f0c88fd1d035ee5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
3.6MB

MD5
7a3ea04eb0b932e7ddcbfa7e3ea56758

SHA1
b9875127e3998610175c837607910d58e0ed5b74

SHA256
46571dd8054637f4c5bfbe482e7fa1cb359d8e3289196577c2a63054008be1a4

SHA512
34d569bdf19c0004845ee4cacd8bc351cbbc06a690cce7452062b3a2790f439f3887e60d64678bef3ad46b955eee32f3bbac88f612068b558f0c88fd1d035ee5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
3.6MB

MD5
7a3ea04eb0b932e7ddcbfa7e3ea56758

SHA1
b9875127e3998610175c837607910d58e0ed5b74

SHA256
46571dd8054637f4c5bfbe482e7fa1cb359d8e3289196577c2a63054008be1a4

SHA512
34d569bdf19c0004845ee4cacd8bc351cbbc06a690cce7452062b3a2790f439f3887e60d64678bef3ad46b955eee32f3bbac88f612068b558f0c88fd1d035ee5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
318KB

MD5
b5fc476c1bf08d5161346cc7dd4cb0ba

SHA1
280fac9cf711d93c95f6b80ac97d89cf5853c096

SHA256
12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

SHA512
17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
318KB

MD5
b5fc476c1bf08d5161346cc7dd4cb0ba

SHA1
280fac9cf711d93c95f6b80ac97d89cf5853c096

SHA256
12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

SHA512
17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

Download Submit