cf4b0a82d0da831d106eae1badbbb6bfbbbbdde3951a51bab3b84f57a0d10c9a

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-23_e53e777f83aea53b8a111655cd724860_mafia.exe
Size

428KB
MD5

e53e777f83aea53b8a111655cd724860
SHA1

afa520c096ac1e751ffce27ed6c56b8dd576e176
SHA256

cf4b0a82d0da831d106eae1badbbb6bfbbbbdde3951a51bab3b84f57a0d10c9a
SHA512

f3229be13a5d8f87787e50bf9908374854ef8250f8f31b5d21c0bb5a2eea4d6e39924841f78c8ab0f78bd80aac90ad81c1317a5eabafb94f69c37b656606a7b4
SSDEEP

12288:Z594+AcL4tBekiuKzErRleIJCfil+xOhLwTl:BL4tBekiuVrR0Nw+G2

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4916	84DF.tmp

Executes dropped EXE 1 IoCs

pid	Process
4916	84DF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-23_e53e777f83aea53b8a111655cd724860_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84DF.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 4916	924	2024-08-23_e53e777f83aea53b8a111655cd724860_mafia.exe	84
PID 924 wrote to memory of 4916	924	2024-08-23_e53e777f83aea53b8a111655cd724860_mafia.exe	84
PID 924 wrote to memory of 4916	924	2024-08-23_e53e777f83aea53b8a111655cd724860_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-08-23_e53e777f83aea53b8a111655cd724860_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-23_e53e777f83aea53b8a111655cd724860_mafia.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924
- C:\Users\Admin\AppData\Local\Temp\84DF.tmp
  "C:\Users\Admin\AppData\Local\Temp\84DF.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-08-23_e53e777f83aea53b8a111655cd724860_mafia.exe FBDE20D8C49BAD9AA4EEB4748600A1E048B8F782986A5E5C4BCB4B36132B53484E4FF432B83A61B7E0A0FA6C7CF489DB411D27159FF9E7CC3F6FA5E87B99667D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\84DF.tmp

Filesize
428KB

MD5
21b1fe5f2eac579d9df015c7b16c8cbd

SHA1
65cc9d9bbe1fa07aa902864cd8c87a78781516e0

SHA256
14c21654acfcd5ff6a0e8b6a32281d28f2c4898801bec245cafccaffd9afb148

SHA512
8b4f0f44dea3be53352544bee54fe7078c87bef77219fd7523cf29c90686b6587d9fe206a098d4b7a14df704e21494efcc8bf51a4025dc6b3573031e45191c81

Download Submit