General
-
Target
2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia
-
Size
11.8MB
-
Sample
240624-zahdbsvcnj
-
MD5
eef64444ae02ed37da2826093fc05d4a
-
SHA1
854da2256f622edbf673ca91cb3014d3d69763b1
-
SHA256
a7009b6d109dfa0a473288b9e463064b04f86d9ea5726e1613cf089f5d89c786
-
SHA512
1ebfff5d3fec92c940bb300cf18b951043463a08267d2087a83dc31f370c788e5a775ac31dc3c8c82e19aae9450ec9db22911dcf07e4329f78155dea6bfdb6aa
-
SSDEEP
6144:h+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:h+r1IeSXMXc7LlxWV4Ug97GZ+ej
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Targets
-
-
Target
2024-06-24_eef64444ae02ed37da2826093fc05d4a_mafia
-
Size
11.8MB
-
MD5
eef64444ae02ed37da2826093fc05d4a
-
SHA1
854da2256f622edbf673ca91cb3014d3d69763b1
-
SHA256
a7009b6d109dfa0a473288b9e463064b04f86d9ea5726e1613cf089f5d89c786
-
SHA512
1ebfff5d3fec92c940bb300cf18b951043463a08267d2087a83dc31f370c788e5a775ac31dc3c8c82e19aae9450ec9db22911dcf07e4329f78155dea6bfdb6aa
-
SSDEEP
6144:h+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:h+r1IeSXMXc7LlxWV4Ug97GZ+ej
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1