a033fd5609a9f374902d0cf252eb1f490b7116d949486f5d9e7dd1315ac53e88

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/08/2024, 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-08_cd96c4db1d52252034d4ef31fcb03c2f_mafia.exe
Size

428KB
MD5

cd96c4db1d52252034d4ef31fcb03c2f
SHA1

3fb41f04df67f6c57ee1cd464003b64da9ac2a60
SHA256

a033fd5609a9f374902d0cf252eb1f490b7116d949486f5d9e7dd1315ac53e88
SHA512

6478eb8a80e13ec8ab14a5f0547f14d87dd0f1a917e081148b6679822e0d8ce8ea578721e93bcf1eb7162b4a0abc262a1ddfe34123b235d61ecdba82147688b1
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mFnJiz9JnBh5wey/xxrdFHSbqHR:gZLolhNVyE+ubB4eGxrWbqHR

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1160	AD21.tmp

Executes dropped EXE 1 IoCs

pid	Process
1160	AD21.tmp

Loads dropped DLL 1 IoCs

pid	Process
1028	2024-08-08_cd96c4db1d52252034d4ef31fcb03c2f_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-08_cd96c4db1d52252034d4ef31fcb03c2f_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AD21.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1160	AD21.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1160	1028	2024-08-08_cd96c4db1d52252034d4ef31fcb03c2f_mafia.exe	30
PID 1028 wrote to memory of 1160	1028	2024-08-08_cd96c4db1d52252034d4ef31fcb03c2f_mafia.exe	30
PID 1028 wrote to memory of 1160	1028	2024-08-08_cd96c4db1d52252034d4ef31fcb03c2f_mafia.exe	30
PID 1028 wrote to memory of 1160	1028	2024-08-08_cd96c4db1d52252034d4ef31fcb03c2f_mafia.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-08-08_cd96c4db1d52252034d4ef31fcb03c2f_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-08_cd96c4db1d52252034d4ef31fcb03c2f_mafia.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\AD21.tmp
  "C:\Users\Admin\AppData\Local\Temp\AD21.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-08-08_cd96c4db1d52252034d4ef31fcb03c2f_mafia.exe 21FF59B60DFF5FC0740908CD0F31E4C59E7C2536E07896AB8D27120CA5A1C276AD10BBB65873BDDF9402CCE1649D394F2E1D6FD53D42248124743CDBB4186E10
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AD21.tmp

Filesize
428KB

MD5
9ebe25b51b981bbdebcff6c464397dc2

SHA1
e5bda15a9ae47609e41463c60a32a89f226a6fca

SHA256
d0c5956c77f0e92e6c8e9478a926ae6aaf105187db69de027c64e7c4f1871bda

SHA512
cd2514ed52a3b440fee747d3bbccc1868f7e74446a4a9786bda6a61dc67a4fe0ceab17836c8bf50730d93f66dc92234de6398fc4a069ed4d1e6881c1f716e93d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads