82647c9b670c771af76c9c793e1a2317262fa9800a3739c50f8e801fd929311f

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-10_75ea29450b1f56ce74f300e089069653_mafia.exe
Size

428KB
MD5

75ea29450b1f56ce74f300e089069653
SHA1

c7d77a45651466203f79e77c0649946e249af2cc
SHA256

82647c9b670c771af76c9c793e1a2317262fa9800a3739c50f8e801fd929311f
SHA512

c3701607407180f831cb0112dafcec0c05e3a10df1effa3dce724e4ce3848ec1fcd9b2b914d1ef9e2136c275dba6437e83f846a581f640867ea7884a431f71f5
SSDEEP

12288:Z594+AcL4tBekiuKzErXPmooy+MTcSdazZC21l:BL4tBekiuVrfmo44/8l1

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2560	F9D9.tmp

Executes dropped EXE 1 IoCs

pid	Process
2560	F9D9.tmp

Loads dropped DLL 1 IoCs

pid	Process
2488	2024-08-10_75ea29450b1f56ce74f300e089069653_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F9D9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-10_75ea29450b1f56ce74f300e089069653_mafia.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2560	2488	2024-08-10_75ea29450b1f56ce74f300e089069653_mafia.exe	29
PID 2488 wrote to memory of 2560	2488	2024-08-10_75ea29450b1f56ce74f300e089069653_mafia.exe	29
PID 2488 wrote to memory of 2560	2488	2024-08-10_75ea29450b1f56ce74f300e089069653_mafia.exe	29
PID 2488 wrote to memory of 2560	2488	2024-08-10_75ea29450b1f56ce74f300e089069653_mafia.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-08-10_75ea29450b1f56ce74f300e089069653_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-10_75ea29450b1f56ce74f300e089069653_mafia.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\F9D9.tmp
  "C:\Users\Admin\AppData\Local\Temp\F9D9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-08-10_75ea29450b1f56ce74f300e089069653_mafia.exe 218141C3E9E61FA0512C44E9BDA44FD43785936151FF766388A1CF3A6C82752B48E95C0AFF2CD7EDF7C0DAC899967A45931286BDEEECAAA6440C5C1730FAAB39
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F9D9.tmp

Filesize
428KB

MD5
e63a452a913599e01898f575915b1c61

SHA1
355e456c0cfb8b553ecf07fe5a3ccbb0e4855003

SHA256
1af0d01352c92cf086d2fc1afc6a9763576ad6b2a2299f08889059c989c66dc8

SHA512
920059a835326572418ec6704a9bf44fc8bc28a3de4e68353717b00562efab3342d3dc3d30e22bebe9004912221d9cfbac564ef2a21e0cc0b284daf6d97c0a4f

Download Submit