General
-
Target
2024-06-13_ba6bc5af556a7e2bff5c50e101b64567_mafia
-
Size
12.6MB
-
Sample
240613-mnztbayhjn
-
MD5
ba6bc5af556a7e2bff5c50e101b64567
-
SHA1
4ff3686f985037568a519a805d6c626ee73c406d
-
SHA256
defcae648b60667a34979197565eee606c992efda1816a4ad7b00991f208eae3
-
SHA512
2f166ded57e325e261920420c61770897d6a224e9a95de7f452258e74264622b12e340259f4602ce8578e390d9ab468ee2e340171cdfc549ee3a76f61d58465a
-
SSDEEP
6144:i+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:i+r1IeSXMXc7LlxWV4Ug97GZ+ej
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-13_ba6bc5af556a7e2bff5c50e101b64567_mafia.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-13_ba6bc5af556a7e2bff5c50e101b64567_mafia.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Targets
-
-
Target
2024-06-13_ba6bc5af556a7e2bff5c50e101b64567_mafia
-
Size
12.6MB
-
MD5
ba6bc5af556a7e2bff5c50e101b64567
-
SHA1
4ff3686f985037568a519a805d6c626ee73c406d
-
SHA256
defcae648b60667a34979197565eee606c992efda1816a4ad7b00991f208eae3
-
SHA512
2f166ded57e325e261920420c61770897d6a224e9a95de7f452258e74264622b12e340259f4602ce8578e390d9ab468ee2e340171cdfc549ee3a76f61d58465a
-
SSDEEP
6144:i+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:i+r1IeSXMXc7LlxWV4Ug97GZ+ej
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2