caa38099ad884421d7114fd9d7ed6d77d054a364845d99ba69b650022ed2ed5b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-18_215114e74b6e19823efae200040f04e6_mafia.exe
Size

414KB
MD5

215114e74b6e19823efae200040f04e6
SHA1

986e18ac5a50bae44e0ba7888d2227354c2add5c
SHA256

caa38099ad884421d7114fd9d7ed6d77d054a364845d99ba69b650022ed2ed5b
SHA512

960a4c3339bd3524741fae7ca22651998fd8d1aae1e095277909bfe3cf6198ad881bc539e9731e06439819beee14319a94f106c8fc5eaee0d780e8d8850481b8
SSDEEP

12288:Wq4w/ekieZgU6jK7/rncPUG8Scufed6MUl:Wq4w/ekieH6jKvMvcOb

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2176	FAF2.tmp

Executes dropped EXE 1 IoCs

pid	Process
2176	FAF2.tmp

Loads dropped DLL 1 IoCs

pid	Process
2180	2024-08-18_215114e74b6e19823efae200040f04e6_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-18_215114e74b6e19823efae200040f04e6_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FAF2.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2176	2180	2024-08-18_215114e74b6e19823efae200040f04e6_mafia.exe	31
PID 2180 wrote to memory of 2176	2180	2024-08-18_215114e74b6e19823efae200040f04e6_mafia.exe	31
PID 2180 wrote to memory of 2176	2180	2024-08-18_215114e74b6e19823efae200040f04e6_mafia.exe	31
PID 2180 wrote to memory of 2176	2180	2024-08-18_215114e74b6e19823efae200040f04e6_mafia.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-08-18_215114e74b6e19823efae200040f04e6_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-18_215114e74b6e19823efae200040f04e6_mafia.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\FAF2.tmp
  "C:\Users\Admin\AppData\Local\Temp\FAF2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-08-18_215114e74b6e19823efae200040f04e6_mafia.exe 9F5BC201ED1AB0F7BFA8A706542EDF99DFED601C226DB53243C980355EF6A6CC9A403865588EBFEFA179F50855019AF0EA0922642A60FC32D0660B0F7A640227
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FAF2.tmp

Filesize
414KB

MD5
d175d10a4b3c498bf310b36f37cff2c9

SHA1
9b4816cfb6fe15b97b73a1df07dd099db44d06f3

SHA256
d55838d32f23b9fc339021ebbc03184a00148d297d22bfc302bac6945e56476f

SHA512
9919f9d274c3c46e5446d7ec571e930d5e0283ef7a5d73bd85e2c3b058469efb8e59aa01406701258103afe60ab868057e2899921b0f1a249d42081a9e55c102

Download Submit