General
-
Target
202406158c3fa6fe70a4c5270a2b9c86d874d0cbmafia.exe
-
Size
14.2MB
-
Sample
240615-1bvwgsygmj
-
MD5
8c3fa6fe70a4c5270a2b9c86d874d0cb
-
SHA1
c6ef5d44c3822e21c25e272eb9cd287485972ad0
-
SHA256
0d371a108223b043a6f04373b049548bbf1ea70acb13235bf38746f3b95e4743
-
SHA512
c2e3548eef8fef1b1f0b9ee77c9d91baa08ffca1def580f0eadd31b4b0793e60ea78004f381fe7e0d446603a754befad9b6ba730369043c73ae9589cb5a50251
-
SSDEEP
6144:/+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:/+r1IeSXMXc7LlxWV4Ug97GZ+ej
Static task
static1
Behavioral task
behavioral1
Sample
202406158c3fa6fe70a4c5270a2b9c86d874d0cbmafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
202406158c3fa6fe70a4c5270a2b9c86d874d0cbmafia.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Targets
-
-
Target
202406158c3fa6fe70a4c5270a2b9c86d874d0cbmafia.exe
-
Size
14.2MB
-
MD5
8c3fa6fe70a4c5270a2b9c86d874d0cb
-
SHA1
c6ef5d44c3822e21c25e272eb9cd287485972ad0
-
SHA256
0d371a108223b043a6f04373b049548bbf1ea70acb13235bf38746f3b95e4743
-
SHA512
c2e3548eef8fef1b1f0b9ee77c9d91baa08ffca1def580f0eadd31b4b0793e60ea78004f381fe7e0d446603a754befad9b6ba730369043c73ae9589cb5a50251
-
SSDEEP
6144:/+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:/+r1IeSXMXc7LlxWV4Ug97GZ+ej
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2