Overview

overview

7

Static

static

3

2024-05-17...ia.exe

windows7-x64

7

2024-05-17...ia.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    129s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17-05-2024 09:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-17_6e8d877b619844b554c85d89f9b9644d_mafia.exe

  • Size

    2.9MB

  • MD5

    6e8d877b619844b554c85d89f9b9644d

  • SHA1

    40dd2942693491db4e89078bd7b5a619abc0fed1

  • SHA256

    d2bf56ae8d9549bee54ad03a2490bdb0eabe5cd672b07dbbcfddae17242a862e

  • SHA512

    ae0c245bb104abfc6f235732ca3a7ad28db2ff03530ed249a3da3142b267c5060fb88a225ad5f5261f4070e467de05ee00f1bc76c8c7c4e80f67a36ae87b9331

  • SSDEEP

    49152:fWnAteSAYvPsqD2AQLRgcTPC4YEeZB92k0Z/6b9HC8ds1mqklFC76g4WRA0Dayz:7teSAYvPt2AQRTPCKez970Z/6b9HC8dr

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-17_6e8d877b619844b554c85d89f9b9644d_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-17_6e8d877b619844b554c85d89f9b9644d_mafia.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    PID:2340
  • C:\Program Files (x86)\Lfnhnlr.exe
    "C:\Program Files (x86)\Lfnhnlr.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Program Files (x86)\Lfnhnlr.exe
      "C:\Program Files (x86)\Lfnhnlr.exe" Win7
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Lfnhnlr.exe
    Filesize

    2.9MB

    MD5

    6e8d877b619844b554c85d89f9b9644d

    SHA1

    40dd2942693491db4e89078bd7b5a619abc0fed1

    SHA256

    d2bf56ae8d9549bee54ad03a2490bdb0eabe5cd672b07dbbcfddae17242a862e

    SHA512

    ae0c245bb104abfc6f235732ca3a7ad28db2ff03530ed249a3da3142b267c5060fb88a225ad5f5261f4070e467de05ee00f1bc76c8c7c4e80f67a36ae87b9331

    Download Submit

  • C:\Users\Public\Documents\pass.txt
    Filesize

    8B

    MD5

    71d864b6b132a9235400af39917131b3

    SHA1

    b79d02acde8be0d57bedef9bd3edeab0a5a066f3

    SHA256

    f4392ea35b8bafc5813b48055be473c4eceb72f11936a67a92cd9086efc2492e

    SHA512

    f331a1c933e016667682d3339784e57f4518305954a7e02643b4deab5ff8ded663232f38190d535457f4351d506f642cea961ea09dc3182c7917f8e483dbd0d3

    Download Submit

  • memory/2340-2-0x0000000010000000-0x0000000010024000-memory.dmp

    Filesize

    144KB

    Download