d8016bd1c534ca9892d687cd9de94361c1a0352954e39faa9731b8ccdee91b57

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe
Size

535KB
MD5

c653bc378192fd9217f222a1460ea902
SHA1

7f25399730a2236e41f6f9c29099723e028dbc62
SHA256

d8016bd1c534ca9892d687cd9de94361c1a0352954e39faa9731b8ccdee91b57
SHA512

b21d60a7d9efab4498f985fc21ed35a7cdb83e83059312f394591c63344f093abc45bc02ec60ad0eebc483fc475f165087ba16abac56ee2ddc05ea2d70f91d57
SSDEEP

12288:si4g+yU+0pAiv+g9wqZ8FQgBzONXtU0Sj85zLc1586xUlvjosTdcG93Dn:si4gXn0pD+48aUzaXzSj85Pc1581lvjT

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2276	3A42.tmp
2488	2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe

Loads dropped DLL 2 IoCs

pid	Process
2512	2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe
2276	3A42.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2276	3A42.tmp

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2276	2512	2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe	28
PID 2512 wrote to memory of 2276	2512	2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe	28
PID 2512 wrote to memory of 2276	2512	2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe	28
PID 2512 wrote to memory of 2276	2512	2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe	28
PID 2276 wrote to memory of 2488	2276	3A42.tmp	29
PID 2276 wrote to memory of 2488	2276	3A42.tmp	29
PID 2276 wrote to memory of 2488	2276	3A42.tmp	29
PID 2276 wrote to memory of 2488	2276	3A42.tmp	29

C:\Users\Admin\AppData\Local\Temp\2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\3A42.tmp
  "C:\Users\Admin\AppData\Local\Temp\3A42.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe 4BB79ADFD383F7DFAC68B642BE96702E333B96C8335B67B3BC4F11A349FB7E425AD98749AE95DB18191C6135CB053520439E20FBB7256A1DEAC51D51BCF7D28D
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Users\Admin\AppData\Local\Temp\2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe"
    3⤵
    - Executes dropped EXE
    PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3A42.tmp

Filesize
135KB

MD5
7bba2fe4fc948fad6e47c42cc5dd22b6

SHA1
33071c979c1539056fb449f449fd7dad436b6ff6

SHA256
020c69fec788de6de21a812b6d50dc270f3b3f693d5db5bed3a9bd21b93d2293

SHA512
65690a3e2acfdab438eb6587e5e1aafc6cc0842dfdc19145e3a55470c25e522ff16aa4501e6b3351dbcc3ecf65c6db0687df1c067a1a0f1cda0e5a531844d6bb

Download Submit
\Users\Admin\AppData\Local\Temp\2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe

Filesize
255KB

MD5
b7fd76103054f562a11ce616d50a0611

SHA1
7473656e5a33b9ecc401985f917f65054bcbd16c

SHA256
aba5c0bff0442597ff8743b4fe7d28de945b78be01eb88fc4a95cadd1fbee409

SHA512
2a2996476dbfdcd50c39c08dc91a179eff4f016013707c9c0972c6e7a0e179b9da4fcff5e2d4d4883a31312bfefdb9a88d1490e1baaa4728a516c5c7f7bdfbd2

Download Submit
\Users\Admin\AppData\Local\Temp\3A42.tmp

Filesize
535KB

MD5
cae960b46a0f69cce89f422387328294

SHA1
90d55f9d7ca427561e32c4d33b7f377670755ff9

SHA256
1cc063ca0ae0d1e432a7a246f5a47022804146e2c703004b79077bb49d2b2b6a

SHA512
81a23f94cba70cd12b80dbaf637bddad4cc2e9d83d9b323819cd2c0498f94e3f0a13792bebffae7a0572deae4515812ae1e8864ec79eda6793c659c73d4f3a78

Download Submit