d1fdb463eb3414317502d6a2934ba7999065cfb3fd216cff68ec4626a2b766fb

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe
Size

16.8MB
MD5

12b91e1d3cb697c7ec6101241900158d
SHA1

32f58f87793d251a6e6fd7cbc51fbcbb5f46ccc3
SHA256

d1fdb463eb3414317502d6a2934ba7999065cfb3fd216cff68ec4626a2b766fb
SHA512

de33d04fced5929e4d96865a2122b284fc145c6b39348c8135380c405b233c623f6f28a6100b2a10365cf992c47f33d764e71e4dc58144091dedf27e4f992867
SSDEEP

393216:rTuvmPY7EyCjPzwSA4tgAr3KBePYeEQtxK4qLcYE:PuvmPY7EyC7kSAf6YelKxoh

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1956	irsetup.exe

Loads dropped DLL 5 IoCs

pid	Process
2992	2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe
2992	2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe
2992	2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe
2992	2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe
1956	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1956	irsetup.exe
1956	irsetup.exe
1956	irsetup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1956	2992	2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe	28
PID 2992 wrote to memory of 1956	2992	2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe	28
PID 2992 wrote to memory of 1956	2992	2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe	28
PID 2992 wrote to memory of 1956	2992	2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe	28
PID 2992 wrote to memory of 1956	2992	2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe	28
PID 2992 wrote to memory of 1956	2992	2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe	28
PID 2992 wrote to memory of 1956	2992	2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:4212594 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\2024-05-03_12b91e1d3cb697c7ec6101241900158d_karagany_mafia.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2297530677-1229052932-2803917579-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
318KB

MD5
b5fc476c1bf08d5161346cc7dd4cb0ba

SHA1
280fac9cf711d93c95f6b80ac97d89cf5853c096

SHA256
12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

SHA512
17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
3.6MB

MD5
3bd09a79ca95109070fde3f6576ebdc2

SHA1
cd20333c0e42caefdf786dcc9690c3c36bda9d41

SHA256
10fdf94af73e3144a1d897c2d5b96378eb6ed119a6cfa6de71976f637c431845

SHA512
3a0efe936f5fb11427eb9def0db0013403a849f5c69ec543494ea2d0c1c1281e0e40959c625c59b039879985a876090078a69a44abaa7608c752efc894ed5c22

Download Submit