23ba8da895fa57cb5bdfc0afdc403a4b1ca1a312d8e11b99af19286280e2b2ab

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-02_df1402740b0f3e053b084d7cf8286aa0_mafia.exe
Size

293KB
MD5

df1402740b0f3e053b084d7cf8286aa0
SHA1

56b4c17d39912febf6843ca9db3746c666eb7fd2
SHA256

23ba8da895fa57cb5bdfc0afdc403a4b1ca1a312d8e11b99af19286280e2b2ab
SHA512

502a9050b6bd6f4fc71ae321def872db6a20e376ad7010a93a6b8df4e36d04ea90d998baad3e7fbe6f167b8ccc20ee19263d8e076edb6ba14e5c350b5dac2b23
SSDEEP

6144:vanPst8v78IwA7I97x4fg+8t9d5Z0DRUIH0xsNJEV:voPstEPwA7I9750Nz0ONJEV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2312	s9096.exe

Loads dropped DLL 4 IoCs

pid	Process
1712	2024-02-02_df1402740b0f3e053b084d7cf8286aa0_mafia.exe
1712	2024-02-02_df1402740b0f3e053b084d7cf8286aa0_mafia.exe
1712	2024-02-02_df1402740b0f3e053b084d7cf8286aa0_mafia.exe
1712	2024-02-02_df1402740b0f3e053b084d7cf8286aa0_mafia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1712	2024-02-02_df1402740b0f3e053b084d7cf8286aa0_mafia.exe
2312	s9096.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	s9096.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2312	s9096.exe
2312	s9096.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2312	1712	2024-02-02_df1402740b0f3e053b084d7cf8286aa0_mafia.exe	28
PID 1712 wrote to memory of 2312	1712	2024-02-02_df1402740b0f3e053b084d7cf8286aa0_mafia.exe	28
PID 1712 wrote to memory of 2312	1712	2024-02-02_df1402740b0f3e053b084d7cf8286aa0_mafia.exe	28
PID 1712 wrote to memory of 2312	1712	2024-02-02_df1402740b0f3e053b084d7cf8286aa0_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-02_df1402740b0f3e053b084d7cf8286aa0_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-02_df1402740b0f3e053b084d7cf8286aa0_mafia.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\n9096\s9096.exe
  "C:\Users\Admin\AppData\Local\Temp\n9096\s9096.exe" ins.exe /e11736239 /u5193805b-c284-4f85-b972-26465bc06f2f
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\n9096\s9096.exe

Filesize
176KB

MD5
a5005e18392994e6ea875edbee57f60f

SHA1
fccb0e7ffc7c62ebb723e888cf874ddae36cd463

SHA256
5a1fbad9a1370cc43b8a7135126b6ddc890cd8fec599b0bf01a1def09b9b8de6

SHA512
e3bd7206412e71c5eeb7be928433f4a1ba26956151ccbb29575d7e17d62d6f586fac861088cdf0d4b3cc1757cb73a27a56f438a2e6f18c956d5a24d70182723f

Download Submit
C:\Users\Admin\AppData\Local\Temp\n9096\s9096.exe

Filesize
159KB

MD5
2b495107931dd4a91612cc0ee651b168

SHA1
76b8247726d70c835a78ce3bd84a02cd3dd4fc5d

SHA256
10cb36bac6efd3961d22332562dd3ac73897e1412e8c73992589a6698e8fb443

SHA512
f2612f9bceb1d835dfb76af10b28138198d922881233bd31e0b7c2708997df25e84114984dc9c8aabc2d8d3008d30021603332fb5dd9633b63eed05f092e494f

Download Submit
\Users\Admin\AppData\Local\Temp\n9096\s9096.exe

Filesize
189KB

MD5
7bb473428764d1e443892fa75bf7ed60

SHA1
f12ac9f2b8ab685afc74eb89d9d60011ec802c90

SHA256
efdf17c87ab93e037b936bbd3696f4d467cfa7e4cb476beb41d5ccf4f06ab7e8

SHA512
b179e80627a36a54f24ca49ab35fd84c2e0058dcea510cf51b7d8e48854fcbba075454d569227d92eea19c6952d7be298f9b18e0e1a38d392bcf144095bcadcb

Download Submit
\Users\Admin\AppData\Local\Temp\n9096\s9096.exe

Filesize
269KB

MD5
5bedbca9b50f0374b405eb0c79ec0195

SHA1
1a0646caa442f30d86f5ba79c35de34a4ab235fe

SHA256
0355e5e23f4f5d2c129c6d5aa680c782898b332a38c02a0b7ef4d0f50b0ea64d

SHA512
007fd12814a7a7e8d4182d69a86a2f06350521aa9daf684e2516bf7f22add1f687940a06430b5169f38e41c99ae8cbcc8d1f7c3218c68a127a8c6fe68c36ee6b

Download Submit
memory/2312-16-0x0000000001E50000-0x0000000001ED0000-memory.dmp

Filesize
512KB

Download
memory/2312-15-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2312-14-0x0000000000330000-0x000000000033A000-memory.dmp

Filesize
40KB

Download
memory/2312-17-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2312-19-0x0000000001E50000-0x0000000001ED0000-memory.dmp

Filesize
512KB

Download
memory/2312-18-0x0000000001E50000-0x0000000001ED0000-memory.dmp

Filesize
512KB

Download
memory/2312-20-0x0000000001E50000-0x0000000001ED0000-memory.dmp

Filesize
512KB

Download
memory/2312-21-0x0000000001E50000-0x0000000001ED0000-memory.dmp

Filesize
512KB

Download
memory/2312-22-0x0000000001E50000-0x0000000001ED0000-memory.dmp

Filesize
512KB

Download
memory/2312-23-0x0000000001E50000-0x0000000001ED0000-memory.dmp

Filesize
512KB

Download
memory/2312-24-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download