Overview

overview

7

Static

static

3

2024-07-26...ia.exe

windows7-x64

7

2024-07-26...ia.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 13:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-07-26_ed1eb5f05bb686196bbaef09dd7ccfd2_mafia.exe

  • Size

    413KB

  • MD5

    ed1eb5f05bb686196bbaef09dd7ccfd2

  • SHA1

    23d1149aa6e5319878cd3286a0870b60e7c7d6f6

  • SHA256

    ea7a1bb74f04489ce3dc56d996e1fe7883bc6844e12f618a011be40c5a936505

  • SHA512

    00545fa8797957c36d70ce0e8245d74bb17586daaa88939ba8fb84182859de8aef39711045fe4e150d65a6188f80d52d1cf066da5fcf0567a78d7d90927a9ad2

  • SSDEEP

    6144:gVdvczEb7GUOpYWhNVynE/mFHnZfZHq4bAhqa+FrU37di7h/HULT0OwqHg:gZLolhNVyE4ZfVhAhf+FrMOh/dOwqHg

Score
7/10
discovery

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-26_ed1eb5f05bb686196bbaef09dd7ccfd2_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-26_ed1eb5f05bb686196bbaef09dd7ccfd2_mafia.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Users\Admin\AppData\Local\Temp\23C6.tmp
      "C:\Users\Admin\AppData\Local\Temp\23C6.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-07-26_ed1eb5f05bb686196bbaef09dd7ccfd2_mafia.exe 6C57AC0496B29920EF10E618598ACE15941195EB6A7D4A09EFAEC2FBC7A8DC77AC7895DE39E694A76ED6DD1014CC0378B9DB5B3CD4AA695D4690B693BA44B52B
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:2332

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\23C6.tmp
    Filesize

    413KB

    MD5

    9a4c0a9cc84267f16b1f026a58ef6e29

    SHA1

    bbd3b5002d28e4759b4c7e4aad090277015e45ac

    SHA256

    b6d30b3bc3645e2909128e19ab073f7b3f1ecea0eebd820bc9aba860a6339369

    SHA512

    6222c207028ac5a847ffbfc8a6c821d54c807973c3345917e1d6a9828c7c7203edeed06d5d15e0a999292ed3e6fdd4b939dab771ac2465d995412fdd477570ab

    Download Submit