Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 21:19
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe
-
Size
14.9MB
-
MD5
59f4267dae33e83b59d952b7d5fe31bc
-
SHA1
d1e6de12cc46bdb05943adde0c03b4b212685efb
-
SHA256
e000777678e885983bbbea7fc659bcf79c7c4ba38d548d3411a58347666dc92a
-
SHA512
927ffd0a7382a54b6561c5d2dc0b948e95498f56dfa194bec4c35f18c2af45e27ed496c884a0d3702537dc50c57fcd967cadda39464e7979e6fe7715f56ee14b
-
SSDEEP
6144:v+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:v+r1IeSXMXc7LlxWV4Ug97GZ+ej
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 964 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\kdiepwjh\ImagePath = "C:\\Windows\\SysWOW64\\kdiepwjh\\ribelykj.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 3860 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
ribelykj.exepid process 1556 ribelykj.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ribelykj.exedescription pid process target process PID 1556 set thread context of 3860 1556 ribelykj.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2440 sc.exe 3376 sc.exe 4648 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exeribelykj.exedescription pid process target process PID 792 wrote to memory of 3120 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe cmd.exe PID 792 wrote to memory of 3120 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe cmd.exe PID 792 wrote to memory of 3120 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe cmd.exe PID 792 wrote to memory of 780 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe cmd.exe PID 792 wrote to memory of 780 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe cmd.exe PID 792 wrote to memory of 780 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe cmd.exe PID 792 wrote to memory of 3376 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe sc.exe PID 792 wrote to memory of 3376 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe sc.exe PID 792 wrote to memory of 3376 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe sc.exe PID 792 wrote to memory of 4648 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe sc.exe PID 792 wrote to memory of 4648 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe sc.exe PID 792 wrote to memory of 4648 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe sc.exe PID 792 wrote to memory of 2440 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe sc.exe PID 792 wrote to memory of 2440 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe sc.exe PID 792 wrote to memory of 2440 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe sc.exe PID 792 wrote to memory of 964 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe netsh.exe PID 792 wrote to memory of 964 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe netsh.exe PID 792 wrote to memory of 964 792 2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe netsh.exe PID 1556 wrote to memory of 3860 1556 ribelykj.exe svchost.exe PID 1556 wrote to memory of 3860 1556 ribelykj.exe svchost.exe PID 1556 wrote to memory of 3860 1556 ribelykj.exe svchost.exe PID 1556 wrote to memory of 3860 1556 ribelykj.exe svchost.exe PID 1556 wrote to memory of 3860 1556 ribelykj.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kdiepwjh\2⤵PID:3120
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ribelykj.exe" C:\Windows\SysWOW64\kdiepwjh\2⤵PID:780
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create kdiepwjh binPath= "C:\Windows\SysWOW64\kdiepwjh\ribelykj.exe /d\"C:\Users\Admin\AppData\Local\Temp\2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:3376 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description kdiepwjh "wifi internet conection"2⤵
- Launches sc.exe
PID:4648 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start kdiepwjh2⤵
- Launches sc.exe
PID:2440 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:964
-
C:\Windows\SysWOW64\kdiepwjh\ribelykj.exeC:\Windows\SysWOW64\kdiepwjh\ribelykj.exe /d"C:\Users\Admin\AppData\Local\Temp\2024-06-29_59f4267dae33e83b59d952b7d5fe31bc_mafia.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:3860
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2212 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:81⤵PID:4468
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ribelykj.exeFilesize
14.9MB
MD5cf962801e797acd716f3376e8ad781f2
SHA1e34f4f135da20bf194ec01ef3f24213aaa75f929
SHA2565838b25850a3d5c26ba706f74a10bf41569298c80faeb9541d85b058ef5d974d
SHA512ab388a33b3ee52453e4a5dfc4b6a11e4475db41911ab492ad4ba34147cc197dee1f83c69d6d0fc7f49c8077b21c5d8791de116ccf22c307b4a55765b16e01527
-
memory/792-1-0x0000000000760000-0x0000000000860000-memory.dmpFilesize
1024KB
-
memory/792-2-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/792-5-0x0000000000400000-0x000000000051A000-memory.dmpFilesize
1.1MB
-
memory/792-6-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/1556-9-0x0000000000400000-0x000000000051A000-memory.dmpFilesize
1.1MB
-
memory/1556-10-0x0000000000400000-0x000000000051A000-memory.dmpFilesize
1.1MB
-
memory/1556-15-0x0000000000400000-0x000000000051A000-memory.dmpFilesize
1.1MB
-
memory/3860-11-0x0000000000980000-0x0000000000995000-memory.dmpFilesize
84KB
-
memory/3860-14-0x0000000000980000-0x0000000000995000-memory.dmpFilesize
84KB
-
memory/3860-16-0x0000000000980000-0x0000000000995000-memory.dmpFilesize
84KB