d8538700423ba52ed9a6e1c38410c397a4a98871e8de2ab3b054c780dd68f763

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-28_16e87bc6047490d5a2afb024aaf3c131_mafia.exe
Size

653KB
MD5

16e87bc6047490d5a2afb024aaf3c131
SHA1

afb0d6930510fb9f08ea67735c53daa992c21cb1
SHA256

d8538700423ba52ed9a6e1c38410c397a4a98871e8de2ab3b054c780dd68f763
SHA512

d42b61ce1b198b000e8d1ebebea31885903af0dfc6ee51274c8a294dea0726939d646e02a0d1f12c94197e52f82dc4b9d5009d8e03c488c2433f673fb256d5f9
SSDEEP

12288:Yij0isJD+m3srW+5tEZG1QRw7rZ0n9sLXxGkgXYhfu0tF:lIiG+m8rWwHfR0yXkkxVtF

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	2024-01-28_16e87bc6047490d5a2afb024aaf3c131_mafia.exe

Executes dropped EXE 2 IoCs

pid	Process
320	minidownload.exe
1236	DownLoadDlg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2024-01-28_16e87bc6047490d5a2afb024aaf3c131_mafia.exe
File opened for modification	\??\PhysicalDrive0	DownLoadDlg.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SogouDownLoad\html\download.html	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\css\downloader - ¸±±¾.css	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\dlico.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\error.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_min.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\img_exe.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\rocket1.swf	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\btns.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_t.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\commonjs\jquery-1.11.2.min.js	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\bg_line.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_set.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\repair.html	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_spr.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\progressbar.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\warning.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_close.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\js\swfobject.js	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\config.ini	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\css\down.css	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\css\downloader.css	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\dlbg.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\btn_spr.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\rocket2.swf	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\commonjs\actions.js	minidownload.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3912	1236	WerFault.exe	91

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0010000000023155-2.dat	nsis_installer_1
behavioral2/files/0x0010000000023155-2.dat	nsis_installer_2

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1236	DownLoadDlg.exe
1236	DownLoadDlg.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 320	1700	2024-01-28_16e87bc6047490d5a2afb024aaf3c131_mafia.exe	86
PID 1700 wrote to memory of 320	1700	2024-01-28_16e87bc6047490d5a2afb024aaf3c131_mafia.exe	86
PID 1700 wrote to memory of 320	1700	2024-01-28_16e87bc6047490d5a2afb024aaf3c131_mafia.exe	86
PID 1700 wrote to memory of 1236	1700	2024-01-28_16e87bc6047490d5a2afb024aaf3c131_mafia.exe	91
PID 1700 wrote to memory of 1236	1700	2024-01-28_16e87bc6047490d5a2afb024aaf3c131_mafia.exe	91
PID 1700 wrote to memory of 1236	1700	2024-01-28_16e87bc6047490d5a2afb024aaf3c131_mafia.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-01-28_16e87bc6047490d5a2afb024aaf3c131_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-28_16e87bc6047490d5a2afb024aaf3c131_mafia.exe"
1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\minidownload.exe
  C:\Users\Admin\AppData\Local\Temp\\minidownload.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:320
- C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe
  "C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe" /Install?status=true&softurl=http%3A%2F%2Fyx.sogou.com%2Fredirectdownload.jsp%3Fu%3Dhttp%253A%252F%252Fdota2.dl.wanmei.com%252Fdota2%252Fclient%252FDOTA2Setup20150708.zip%26pcid%3D7097013680706490436%26downloadtype%3Dgame%26filename%3DDOTA2Setup20150708.zip&iconurl=http%3A%2F%2Fimg03.sogoucdn.com%2Fapp%2Fa%2F100520071%2Fff82994a024a0f096d15edb802b0c941.jpg&softname=DOTA2&softsize=8989884903
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:1236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 1572
    3⤵
    - Program crash
    PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1236 -ip 1236
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe

Filesize
560KB

MD5
03311437428117fb004eec8b38b62cca

SHA1
394c7c27c61d4e341f64c2be812ffac2ebe8c8af

SHA256
0565e862198c1979c5d58c8b6120c15601c668c9adcc3c545c5f2f27c85c3edc

SHA512
fe719a26feed2c6147c4e71a4d732afcaf59c2146d6d8adbfa533dcc3af1d2c11d6174371f4d4babe6cac2b6cc438626a14e7f02ad5e9e2fe506351891d8f4d2

Download Submit
C:\Program Files (x86)\SogouDownLoad\commonjs\actions.js

Filesize
7KB

MD5
59bf1a7a08d5e3b066a650351197f0af

SHA1
833d0f6bff8b4daf936b8902e375a942d3d831e7

SHA256
fa2fb59f16ccb6ec42ad804a270654b1fe50fc5303a39df734621efd96daad30

SHA512
fe7edeab6008a51885932a0cedcffa73327029c5a6bae636b0fc25f52f60b38d795f01e56bc1071b911d2f77aca2b644461f5f52398fead735bdb74959876592

Download Submit
C:\Program Files (x86)\SogouDownLoad\commonjs\jquery-1.11.2.min.js

Filesize
93KB

MD5
5790ead7ad3ba27397aedfa3d263b867

SHA1
8130544c215fe5d1ec081d83461bf4a711e74882

SHA256
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0

SHA512
781acedc99de4ce8d53d9b43a158c645eab1b23dfdfd6b57b3c442b11acc4a344e0d5b0067d4b78bb173abbded75fb91c410f2b5a58f71d438aa6266d048d98a

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\config.ini

Filesize
76B

MD5
eeb80831da6c34ee872846edce4d6a03

SHA1
c3c314f5936b95b8a33eed6d39b2f7309e517bee

SHA256
620f10c15a1d7e1cb122234ab2c862f201913c29865282733cc42db0512a485b

SHA512
86162a73410639731790950b46a726321d183552217fe3473fa549e193afa03a30876b8180e8dd0fd7990b3452a31e1f02d0ebce21b361f70224303ded8f75a3

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\css\downloader.css

Filesize
5KB

MD5
7b73753cd524c62838f1031e52b6310d

SHA1
21d962ff343263f484262cc246ce9683dbac89b3

SHA256
e3629d6e735ac18a47c36c4a8a3caf2469102eb6abf12d938a82df16bb012d4f

SHA512
7f5ae1c87227671bd91f8a65cae9ee90976d2a427a2a5530b754ef5fad80e7d096b53e31f715cd38553f8b56776d80176a927419b467a169929f41ce185b5248

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\download.html

Filesize
6KB

MD5
f122f616e4b32a843d7f6803bea9a10f

SHA1
9a8eed20175b74821f2678ea72d086d55330bb42

SHA256
f9d5aa213ccbd78f98d6b1978e378de7a1b37b1fbffb93e4ea1f1b914a720e0d

SHA512
aa5a1595c785469dc2d68dcfe20af232baa0bff2f96f3276a14ba2f925fc1316ee50b694fb193d8d963e10656cd6da9e623fb54ca6a201fae3aca4a64319f7b8

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\images\btns.png

Filesize
1KB

MD5
c2cfc62059b6259d5db8b7e64b76ea0d

SHA1
eaf2eb169b87faeb829e124ce6e6f9f292f7f266

SHA256
ca281adf65372f5fc51f621fbe93a935629e2d979958ffd3f5f695cf7bc3d23e

SHA512
7e007989e19a8735ef7bd8c467ed213fd3321e81af2980d3a93403098f53fbf0df0a6f9bcaad794623d80fb05cbcc293b49c73c76a05be970f689d9f21bc3346

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\images\dlbg.png

Filesize
25KB

MD5
b6b31a4d23c2664b87dc8bf1fcf8ff22

SHA1
17f27a514ef7119080be4ae9dc691010acdc43fa

SHA256
5ece2e217e6a50b2ecc6564601c1da92441c73a1a34a3c6c5d207d6726df8756

SHA512
5506ed1fba0e3fa471c83240266ff329fbb23ae862955a5bac358ae506c90d4c03227a710fc548ca5510eb711b95ecce75c63323c30766e3dd081c081b5829cd

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\images\dlico.png

Filesize
348B

MD5
915d0422e8b87e694bb052287e45de06

SHA1
ae5f77eda69dd12218fc542279fe9e4e0a85db22

SHA256
5fa5d3bedabe22c5193b5eace4ae3be80a5c8c6271873e1d915bc42c525ce689

SHA512
4392768182f58bb14aad04d5f4287447eb239b6387cb7371def0ce25bb940be88d32c366e7c483cfd604f0aa7a11171084411530389926f3eb6cc1f9f9847852

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\images\img_exe.gif

Filesize
657B

MD5
0e0ac8352cd69f396f271fa32f3ab554

SHA1
ed6d306a5033707f45477df3318a53d15b47cf43

SHA256
c2c34d6bf4e17b756954e409dc9b5663169d68997abd722ce1e86473b769f10c

SHA512
5d2528489c21600f16f04559500be3ebe9db5a1dc7bf9abc9c1312187b4b8b7bc5966f9eb2a38e26bff26c854a6d964fa156641fed9501cf0e7befedb60fd7e0

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\images\progressbar.png

Filesize
285B

MD5
7db33b5890d916426f77d585ab3c4fa9

SHA1
99a794c3a88803ae289c7ea6f0d733e22a3b799b

SHA256
5585318ea9be125540f00f04b05b29da3816ef97ce837a22a2eaee2d5d462d9b

SHA512
9800273f1e605b946dd553cbae650270c5bf2af7909a4836aa81907f9e30ca348a3552a1887e3357472ca1b93fa8361a17bee3fb742fb5a2d0c1b47a5a47c773

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\js\swfobject.js

Filesize
10KB

MD5
631f38cfac458788af482eba736e5ac3

SHA1
b1d09def39ec74eff2c9e0aafe0a7c12e7650150

SHA256
13e6cf03cdd65a8174cce7b0cb40c9821d2aff04a79c3374e8664fb0abb5694d

SHA512
3ae47c895cd586b1dca8bdf65c58bc896b27837881cc42bb7b3d55c9a71ea9e857939a69c5146b445b64714996393d1ec9c0d95b18d18fd5cb48f02bb8a53f42

Download Submit
C:\Users\Admin\AppData\Local\Temp\minidownload.exe

Filesize
324KB

MD5
8bde3d87157322360828ba6e8dd43073

SHA1
b502f83f19da64826257800db1f62d15bbdabc7c

SHA256
459e67cfd20eaa1b7768e1ad845c90f72f4c2643d428f5cd8551f7b364382307

SHA512
c60d3fc3e130e164349a751a3c42d922ea4d46b42198da5a03879bdf0990ba94549bd36682d4e1e0bb2c13b4865f2d650e3967d963cd8e9deee7c6353cc3af16

Download Submit
memory/1236-33-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads