d60b57e55562af375f14b982cd923f5a51a8d3b126e19e1b6c5d223c267fbec0

Analysis

max time kernel
143s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-30_90d65e438326af50368ba5adade91127_mafia.exe
Size

800KB
MD5

90d65e438326af50368ba5adade91127
SHA1

44d65ffb4866b62e50e748d06a35bdcf3f6ad9d2
SHA256

d60b57e55562af375f14b982cd923f5a51a8d3b126e19e1b6c5d223c267fbec0
SHA512

df8b85276f2a3014bf48e92e371a154c8802ff9568d95d3e126ae5d41ea803ac08b99c02bf9b2348b51c0d4cc8368231b0ee82c719e443898534aaa7c2eea921
SSDEEP

24576:5X47adsXAtYKzIdHdOgV6gh8yOZ0blPR:5X4WdsXMzIpog8gB5ZPR

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	7ACD.tmp

Executes dropped EXE 2 IoCs

pid	Process
860	7ACD.tmp
812	2024-05-30_90d65e438326af50368ba5adade91127_mafia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
860	7ACD.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
812	2024-05-30_90d65e438326af50368ba5adade91127_mafia.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 860	2376	2024-05-30_90d65e438326af50368ba5adade91127_mafia.exe	84
PID 2376 wrote to memory of 860	2376	2024-05-30_90d65e438326af50368ba5adade91127_mafia.exe	84
PID 2376 wrote to memory of 860	2376	2024-05-30_90d65e438326af50368ba5adade91127_mafia.exe	84
PID 860 wrote to memory of 812	860	7ACD.tmp	91
PID 860 wrote to memory of 812	860	7ACD.tmp	91
PID 860 wrote to memory of 812	860	7ACD.tmp	91

C:\Users\Admin\AppData\Local\Temp\2024-05-30_90d65e438326af50368ba5adade91127_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-30_90d65e438326af50368ba5adade91127_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\7ACD.tmp
  "C:\Users\Admin\AppData\Local\Temp\7ACD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-05-30_90d65e438326af50368ba5adade91127_mafia.exe 41BD31E47F1DCD9445D627BBE90B1BCE5F7913F83CB5BE00711A37F3DD49CFAAF0C1BFB171AD95906B654C2537D3AE15EE12F0589AA6B5409B3BEB43A6EBBA7B
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Users\Admin\AppData\Local\Temp\2024-05-30_90d65e438326af50368ba5adade91127_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-30_90d65e438326af50368ba5adade91127_mafia.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024-05-30_90d65e438326af50368ba5adade91127_mafia.exe

Filesize
395KB

MD5
a540d62254f68c896adb5576f7ae6663

SHA1
b8f7b11e0ec93e468912e4bf921928a7b2a10561

SHA256
b17a386407de08ac6202d61e06832a133652efd6108557a94a384cbbe241204a

SHA512
0ff36593131c0c8702f228e0e485dacbd6d5a59916ac76f4e13c5f040e2f1d3d52234c93112c38469eaffdd127d83e50223e1cbac3514dae23d04ac90d3e5b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp

Filesize
800KB

MD5
92911b56491fad3441a200d6af13bff1

SHA1
245b5379bb9ad8f0f4c56ce7a1dcab0741931c28

SHA256
a3247491f45add80a59459cdab13aa6ebff9a0788f5f1b9bad39795fac532ea1

SHA512
9c3468e0d07edf81244dab68ecee5f3325997b7a486644be8a5f45011c8f4261fe3c311fd1285b5b2f48f9bb10558bb1d05f485af639eba9185d966551c10db7

Download Submit
memory/812-15-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/812-16-0x0000000000590000-0x0000000000592000-memory.dmp

Filesize
8KB

Download
memory/812-17-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/812-18-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/812-20-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download