Overview

overview

7

Static

static

3

2024-07-26...ia.exe

windows7-x64

7

2024-07-26...ia.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    141s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 13:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-07-26_ed1eb5f05bb686196bbaef09dd7ccfd2_mafia.exe

  • Size

    413KB

  • MD5

    ed1eb5f05bb686196bbaef09dd7ccfd2

  • SHA1

    23d1149aa6e5319878cd3286a0870b60e7c7d6f6

  • SHA256

    ea7a1bb74f04489ce3dc56d996e1fe7883bc6844e12f618a011be40c5a936505

  • SHA512

    00545fa8797957c36d70ce0e8245d74bb17586daaa88939ba8fb84182859de8aef39711045fe4e150d65a6188f80d52d1cf066da5fcf0567a78d7d90927a9ad2

  • SSDEEP

    6144:gVdvczEb7GUOpYWhNVynE/mFHnZfZHq4bAhqa+FrU37di7h/HULT0OwqHg:gZLolhNVyE4ZfVhAhf+FrMOh/dOwqHg

Score
7/10
discovery

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-26_ed1eb5f05bb686196bbaef09dd7ccfd2_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-26_ed1eb5f05bb686196bbaef09dd7ccfd2_mafia.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Users\Admin\AppData\Local\Temp\71D4.tmp
      "C:\Users\Admin\AppData\Local\Temp\71D4.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-07-26_ed1eb5f05bb686196bbaef09dd7ccfd2_mafia.exe D088BB4EEB1B968D637E9123F8CC47C730A89843BF64CE66AB8122D160B5A22F08683FADBE91570F042C512F88E412F100D628248C35E9EE8D4ABE00516682F9
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:3040

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\71D4.tmp
          Filesize

          413KB

          MD5

          423fa5f5008d1517cc10b39f704fb9ef

          SHA1

          94a28513c1900d3c616a1397634fde58b04e5530

          SHA256

          87184aedd60e9e775e71532c9de80849c29694d1b0b16a710e3f088ad5c7e992

          SHA512

          94862942919457783a51c4edead0154b9492ddf57b7a8ae2d8b02a0e1e16a1f1b7aca89d0f7e0a1f354ba1b85fbfb06d99397c06bbda2d6a0ada27df5f6685c7

          Download Submit