Analysis
-
max time kernel
147s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
27/05/2024, 14:29
General
-
Target
2024-05-27_4c097db3aa3c3d236e50afcff85ac0b9_mafia_mirai.exe
-
Size
19.0MB
-
MD5
4c097db3aa3c3d236e50afcff85ac0b9
-
SHA1
9375fe626057b279b40273659451caa62bd151dd
-
SHA256
f4883ce47c32bbb394bd4ee98918a2d137b5f3a7fb13e79e6cbaf18a169ef2ab
-
SHA512
34b6e24dbc29079f41a311715f7e617e2e2911d967610b38df8ffa15d6a7b0845f006f1e0f0272f1a9a6632cbb90ded47a343642d88074adc142ccdc828cb913
-
SSDEEP
393216:6LVaeIyIbVpM5/VDuF1juxq/pnJtJNv8V1+3:CbItVIVD+9uxsnJtJNv5
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 64 IoCs
-
ACProtect 1.3x - 1.4x DLL software 16 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 48 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_4c097db3aa3c3d236e50afcff85ac0b9_mafia_mirai.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_4c097db3aa3c3d236e50afcff85ac0b9_mafia_mirai.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pwo5.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pwo5.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pwo5.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pwo5.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\pwo5\svchost.exeC:\Users\Admin\pwo5\svchost.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\pwo5\svchost.exeC:\Users\Admin\pwo5\svchost.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_MEI47162\bin\winlogon.exeC:\Users\Admin\AppData\Local\Temp\_MEI47162\bin\winlogon.exe -SOCKSPort 33156 -ControlPort 33157 -DataDirectory C:\Users\Admin\pwo56⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\40423.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\40423.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 23323⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2888 -ip 28881⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.5MB
MD578b71ecc86e8082aa679b00debbaa77b
SHA11c77ee8775dbddf8adab9ec49c1ad91ac48ebe04
SHA25619444a04f99094828f430a707aba842c8c413024c89f6c02d8dd8edd0f0f5405
SHA512db7ad6c6312e22bfff28ed28567610c18d52d0bf52f32d0e01c078c1e46fda52be36ceccdf5cd7fc324b0634d2bd12a35e80dbb9f902367597c02bb15ed9c70c
-
Filesize
7.3MB
MD5b519f24092f54838118072b326341ee6
SHA1ac727b31b18d7eae3289448ef6b7c9a5903acf74
SHA2568420e6fc7d01110af96178a2e65ef9afc1396ea0f7f99f108023d31e45f26bfc
SHA512208ac11471596920edc3ff47980e6099cfb70a95c066060653dc66c4cc338ce3e61bf58ccba72bc03d7cea8d5e6243e67a2038696c9335da3af444b963902f39
-
Filesize
33KB
MD5ddf742c6c8f900158564a4cdd2e1ed5e
SHA178b20c4949bce6ee45715a818e139fe9ad1ed8bc
SHA256ae4abcf0a4c8b79018f4b6d545809e8cdeaa454375151b13ed5236ca27682b01
SHA512957f48c22eb0cdf5e6e51569dbb58e29efe8e4acf69334443c5e8936fcddfbd7a7e4537005b64664c24555319458ed1fb21ab5cf023d32812b1328eb13e8ace0
-
Filesize
104KB
MD521917b2f3bb8366103f60675db9cda3f
SHA15be1d08ff1c156faedf8761dfd8095f5154c43c6
SHA25627acc2baf1b3d5b7f7ed360ad4334e43cb86a3e3de5a9e5df1960bb26120b02d
SHA512f914363fdba5e4a2473fb449948df4e32d134a7369a9df54268ef5393ef0aa84a89859a3b88a7c03bc0808b7571ed1a3f7fd053a33a8862b5f74d6daccf03046
-
Filesize
13KB
MD5f878c3ea3e3f61091ea5889428eb56ed
SHA1b3016899328c19a54accc342fe96b612e42afe85
SHA256c9b85ab25fe2a60f058ff875c0bb03f885c3988d480621449fbe0755a015156d
SHA512192090eab534ae906b2f3440e7b19d4495f01c02ef59169d10d6009b3343da7251d69595d469590307e2631b91d43604779ffa8579dc9791dd1e09b4de8644d2
-
Filesize
18KB
MD5c4326ac83afd464cfe5acc3c392ec038
SHA10449572ffd71bd3222d470c37cc6a2a4810e835b
SHA256682372936163cbd44da05d56958142f9b475756a1a90ac1b5520687f2a74fb74
SHA512a65bdc52e2165fdfd9eeeb32d5e8d641724881412f1b399a5c1fe5895284394e10cac566e08c35cf7238f4a1a42adde592500d16b12fa76eaf0b58ed19c10219
-
Filesize
20KB
MD5af564cdf235c69b0c8ee5c9e2465b685
SHA146506d46cac4c22d8ec066adab1b746f9923879f
SHA2568835001363ac5004118b9d345ad514d65112d40a0fc03d8cc93a92e27b936efe
SHA5128eb9b6b3ad3697d2ce1f71f0027428e4d12f25cac9844707d0b56262bdf6d9d8802e6de8163a724d628168e4c91585678651986140cd67ff6ce08b52e3652139
-
Filesize
264KB
MD5b5c856714deb16a1ce8f41ed71e00e58
SHA17cbba017e85c438c938b8bbd3afbe4dc56625a89
SHA256079dd93c4abc33295ea8b2cfd4d52d32e9dd61f1d0596dd3b6b5544a0169e2d9
SHA512bc7aec1e2cd9ef0c962cf246fba1481c82e2746798410df8808714b0bf160744c73fe99a2ae2ba29fa2d4917d59d82fabed65cacb32f861ea5f6fbe744e2b1b6
-
Filesize
56KB
MD5d9fee3a6bb8aec510dbec5a55fbc3d16
SHA18600102a3604a30ad917787eaca772c7de9d140f
SHA2567244a58eb526bb275d3fe7fa9ceb7b3dbe921f937eddfb7de4866eb5fe2cd6b2
SHA512fea532a13be386a57fc0db20a0cfe1b69203f791f2fcb7471215ec1df0e31f1325fa66f37d5a982ab8afeff30f06d6c1879849c69a3acb0bc8a3c87748ed942b
-
Filesize
133KB
MD592a833a8d5cd5ee0d2867f7e9dac1ae2
SHA1d736583f854462f316e8a8a831371ea0867f3c29
SHA256d528726d30bb4b4779729461a2d21348feaa7985507128e6b41cab3320807726
SHA512ec73ebcd8cd48af59b8f926a5eb95bf1ca4e04e0c4bf6cc73cadd87d6c0b4d86b9bacaf859c84f70b54b2b740a5a5752fdd8f8fa060c1633201dcb122bf0affd
-
Filesize
58KB
MD54af723714e507fe7e1456ef127628db0
SHA19ef270adb5c41f83fad02750cd359395e79a1094
SHA256b29ae337e386c9e3244e39418b4c5f4b931896b8317f28c5b955b005be474d4c
SHA51271934f270b13daa9815f0ac48ad7f46653c4c4a6f39f2dd9de6642b42bcdf4e6d4c25bcd122c192f20dbac7d6a686e8641a2cc31046c6dff7a28875161ccf71d
-
Filesize
18KB
MD5e08b4d34c1fe73345990a6c419b40a05
SHA1f5972c3167a841d7a6741488266eff2df6b559f1
SHA256ee19e9e64d11f3932b280a0bd86ab5417a1260559c8107f663f1d909fee2712b
SHA512d1fbd5cd443b6be2d045ada1d8aab3dde5ce25db8aed6cc9a48058ade69be859310141fe226a841e18537d62013a5af07c7e69eaa2487bc357493701405580ac
-
Filesize
20KB
MD55c866ba4d12ad465bd8bcc30909f114c
SHA1a3d33c887e7299df13611d0ec73d0ffb044f2bba
SHA2566e7da932220f6c7198251a7ecaca6524e534b7fb7a56b9179fdb8333ff7885a9
SHA5129c2914794b3f25a9dc4d14d7baf41baae52b05bd6d008d71a60db32db10767344c5a10ee76af057e01d97b564bfdf3f299879eae0ca8e9579805873424ec00b9
-
Filesize
962B
MD5f1f2e236aacb3356b1014fae1ca88568
SHA1bb7645923ff5f2b53705635cbd15fa27fa76d4fa
SHA256e6f82642d01f4f8e996cba9685cfcb1aca06a0a019c7c24d02db7c47ae514bbe
SHA512696b2a180d85d0db051f58183a40c97a2ff2c65ab88fffd644fefd03e3fdd89f94810f86cccb50e83445aa94a4155043ed6846b67339f8a9e452e4b5e222c1b1
-
Filesize
13KB
MD52209d7d989a6540beb27c73cd37de0b9
SHA18a626b2e04f4da8d395e59c6ea2a655915b7572c
SHA2565e9c03a81e1d0b7b307e4f0bed7ca6ec43ab4b233b957a772d5a2cfd6c31e358
SHA5121013226bd500671f33d30e1d22e95f2baaf59c4d099b79934385892bb883ca73a265aeb38c65a202ab8dac1e2a7d95a1a8702889dc38e412dbd403799b556ce2
-
Filesize
851KB
MD574305738e630aa757f1072c6c9d50f11
SHA15a9fec6abb9206bf6c64b9b8af5a49cce3bbfcb7
SHA256e169f756f13fe290d86532385167c249a1ce28035dc80ed15ca93f3239dff1c8
SHA5129e885e0680f503e280eb40dee814e3794430ab5288cb4370e0ad3b13507cfe38c2e8d736ff225422b369a3c55a96db58e60ceb559d7da2a42ed89b122bd8b0d9
-
Filesize
109KB
MD5123a6d0b4dcb3ca738fa67a9fd04acc3
SHA115d7f270e39d0b2bb2b3701b51fd63e5c6da0726
SHA25614c07a4a75ac8bbee303310a44452e219c8fb0b0c9e50aed8c1883d864a3b75d
SHA51284431e1b4300fa195430d4da4738facb4e8925045e998ca0dc8da5ba05f7ccf7f8a32e6553c12eb69a324ae3b13580ea91fcbbd1c612b84e891a7022dd77a829
-
Filesize
51KB
MD5b5a143bbf97a0e53a60a5071da7e332c
SHA1f6158de44430a29c61c6117d77b0db87ad528f59
SHA2568596ede6ab99d6e18bcf3d298b08cdd09d3076634a2ec89aa2d41624a1d3969b
SHA512728af5782e9936c64bc5d62ce9960c942b5d60f635ff926a3ad884c179220c6550ab7d2e24caf330c4c487e14aad9aec95dfddf017d0154ea0e17ea4ea6c6202
-
Filesize
9KB
MD53449bbfac55bfa14cdfd83e2d90f3d7e
SHA16bd778f81d672453b06e09dd405bd45e22062a70
SHA256edccb048476f4b029eb3e675b16e0cfbe0bbc4d795977e4c7fcf6ae520d453f1
SHA5122eebe36f2ff1b60667f242840d7c6b2ab9507a9212a1ef8b8f4916b07667e1235c288edf2157183b2bda575462f3e4f128329db26539512a9b51c5c62436153f
-
Filesize
33KB
MD500aa1eacd754a29ac91324427cdf4e7e
SHA114cf21774a76083d6b26784071c6dd9750d50510
SHA2560358a9a94f9489267923d78536f1fd55b81ff06fabdd6d1e700cca89e8165bf2
SHA5120f85796fcb250e8db87015ceea57e25c18269de3597472cd2238b28a6662135950ed587995d686a3ee3dfd34827fe7fe6e2c08beb8be2afe7b30492a8ff4695e
-
Filesize
70KB
MD5311af8755345d435a435fa96a55f2145
SHA1b34a19d4d1524e6bcfe84e770c484ee0e227407a
SHA2567cfdcc1fea438e0b06864369605d0291ea12e6598306f80d27ccb23e122e9e49
SHA5126ac98e95f597d1a6dbcafe8c68ff46256d19b507fda367f789ea9bb220e6f9f1253e81ec18e3aa67092c06c2fbef03aae9eb2a277c6dce6aa9c17199d3a4ef2c
-
Filesize
34KB
MD5233e204cdd364c4b2a4fbbb3b310abf0
SHA1cf4263989e3098330b2b7e2e37df547ad65022e0
SHA256a8501fec10d3ada36d01aac09185a8312dca7d19d09bbea598486edc316d6898
SHA5127bcb8565f6d2e781e554521791b21b237b5badf6843b412f1b0798891efd8144599af3a886bf610d831da1849c243c3cf1068e12aca357b5bd39585c53492a20
-
Filesize
42KB
MD521d919030a29f626219b3da21d75bd30
SHA1e753fcedbee130b9c51fb39d82a35b0e975e1e7c
SHA2567a79a5c601d280177ab7f4a9f5bb20d5199aafcc4ea9acbc549bcc1a89eb04a8
SHA512fd939f1a81fbbff93ffda51bfda8a9886a512bb0c4c3a2b50f408cf0ae7f34d6f8d68514170b2a4f575ee8adc67e46987068a1b735385446db1586429d1d51b0
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
308KB
-
Filesize
196KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
316KB
-
Filesize
2.3MB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
136KB
-
Filesize
156KB
-
Filesize
440KB
-
Filesize
308KB
-
Filesize
760KB
-
Filesize
64KB
-
Filesize
440KB
-
Filesize
100KB
-
Filesize
148KB
-
Filesize
156KB
-
Filesize
316KB
-
Filesize
44KB
-
Filesize
2.3MB
-
Filesize
64KB
-
Filesize
2.3MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
156KB
-
Filesize
100KB
-
Filesize
316KB
-
Filesize
308KB
-
Filesize
64KB
-
Filesize
308KB
-
Filesize
2.3MB
-
Filesize
64KB
-
Filesize
196KB
-
Filesize
316KB
-
Filesize
72KB
-
Filesize
44KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
760KB
-
Filesize
196KB
-
Filesize
64KB
-
Filesize
440KB
-
Filesize
156KB
-
Filesize
136KB
-
Filesize
316KB
-
Filesize
2.3MB
-
Filesize
100KB
-
Filesize
64KB
-
Filesize
316KB
-
Filesize
760KB
-
Filesize
2.3MB
-
Filesize
156KB
-
Filesize
64KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
316KB
-
Filesize
136KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
316KB
-
Filesize
316KB