d8016bd1c534ca9892d687cd9de94361c1a0352954e39faa9731b8ccdee91b57

Analysis

max time kernel
173s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe
Size

535KB
MD5

c653bc378192fd9217f222a1460ea902
SHA1

7f25399730a2236e41f6f9c29099723e028dbc62
SHA256

d8016bd1c534ca9892d687cd9de94361c1a0352954e39faa9731b8ccdee91b57
SHA512

b21d60a7d9efab4498f985fc21ed35a7cdb83e83059312f394591c63344f093abc45bc02ec60ad0eebc483fc475f165087ba16abac56ee2ddc05ea2d70f91d57
SSDEEP

12288:si4g+yU+0pAiv+g9wqZ8FQgBzONXtU0Sj85zLc1586xUlvjosTdcG93Dn:si4gXn0pD+48aUzaXzSj85Pc1581lvjT

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	9B12.tmp

Executes dropped EXE 2 IoCs

pid	Process
760	9B12.tmp
3716	2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
760	9B12.tmp

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 760	972	2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe	92
PID 972 wrote to memory of 760	972	2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe	92
PID 972 wrote to memory of 760	972	2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe	92
PID 760 wrote to memory of 3716	760	9B12.tmp	95
PID 760 wrote to memory of 3716	760	9B12.tmp	95
PID 760 wrote to memory of 3716	760	9B12.tmp	95

C:\Users\Admin\AppData\Local\Temp\2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:972
- C:\Users\Admin\AppData\Local\Temp\9B12.tmp
  "C:\Users\Admin\AppData\Local\Temp\9B12.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe 02FC7DAD88986676D4EB6B76E5A0659CFB6FFFDB08FA8C0DFFB0095212DAB7540F512D76F8B15105C1EB0A04D5309AC7E3B7CEC2049287928E375643EE2B4183
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Users\Admin\AppData\Local\Temp\2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe"
    3⤵
    - Executes dropped EXE
    PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024-01-10_c653bc378192fd9217f222a1460ea902_mafia.exe

Filesize
255KB

MD5
b7fd76103054f562a11ce616d50a0611

SHA1
7473656e5a33b9ecc401985f917f65054bcbd16c

SHA256
aba5c0bff0442597ff8743b4fe7d28de945b78be01eb88fc4a95cadd1fbee409

SHA512
2a2996476dbfdcd50c39c08dc91a179eff4f016013707c9c0972c6e7a0e179b9da4fcff5e2d4d4883a31312bfefdb9a88d1490e1baaa4728a516c5c7f7bdfbd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\9B12.tmp

Filesize
192KB

MD5
1b0913daa5d23e322b6d4655c0773e3c

SHA1
c0e313f302e15b028b32b74f18c9bdf50d70c6fc

SHA256
a969811f281814907da41af6765addd26c2bec37ea344b42140460e0dddbf082

SHA512
a53cb407c90d919693358b43aaaf43e68cf35373bbf5be04fd817775dc6b235c33767ae17f7ed22b32a0565329c884658c0c6e24e1be075a1ec1ad6c2d3602c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\9B12.tmp

Filesize
535KB

MD5
73af0c92fe723843e13cdf5906b7f2ad

SHA1
dfbaef03ec294b99dac4e5f2b7c2b4691829f74f

SHA256
2dc106bddd951f6fa0d0bdded582b05a3604bb19c7184baa2e67a540d70f715e

SHA512
ccd63930d86d86fdfd2862b2e356de51ac1add9fe6b8249ad52f908fd4d009eb2f4b963f3fb424324c75c5e7e1bbc9f6ad6be578a5ee12dfe103f8d9db1c2282

Download Submit