77d7dc0d3094da0e9d4e5d002d946f005121326297af66ae480414f86d00dd2f

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe
Size

414KB
MD5

e0207c5f11f53bc874c28e9d835dca16
SHA1

93802b903c251bf0a7d88be6fc0d3504f5159c30
SHA256

77d7dc0d3094da0e9d4e5d002d946f005121326297af66ae480414f86d00dd2f
SHA512

a23e0102020a7e6eebc1dae4ca60bfcfffefe2f5e62608624cc86c821f2846e3f57855cd869c515b4c340fa03887fc6e5374f0539c2bcb7aaacd1982829c1382
SSDEEP

6144:Wucyz4obQmKkWb6ekie+ogU6BY0z6NtxYnUNVgwIJOE4WXsIjnj1qxzR+dMTlx:Wq4w/ekieZgU67WlYncpYLkxYd+lx

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2332	1FA1.tmp

Executes dropped EXE 1 IoCs

pid	Process
2332	1FA1.tmp

Loads dropped DLL 1 IoCs

pid	Process
2292	2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1FA1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2332	2292	2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe	30
PID 2292 wrote to memory of 2332	2292	2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe	30
PID 2292 wrote to memory of 2332	2292	2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe	30
PID 2292 wrote to memory of 2332	2292	2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\1FA1.tmp
  "C:\Users\Admin\AppData\Local\Temp\1FA1.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe 428058A44CA6E1459597AAED26F6082AD01747B4A5B81133CDBBCCF397AB1A8E167134BD415F717B1F7FBC3A04F93346E1285958991E44C5A01BA715B3A94C48
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1FA1.tmp

Filesize
414KB

MD5
f609cdcd95a23c3be61b7e2ffbe56c44

SHA1
afcccf27088874719ed3d3fb0d9794ff5b1ae880

SHA256
bdef3b2be7dc3854e3b10d86e4c61681b778fdb3b64773de34616f39d4983c10

SHA512
25b58680f074c3536f31a1383566f20a8ae0b3c8fecfbd220e00e28abe5363ad460672416df1c639049cfe01555a3a94a457da13d35cdb1d930bdfbccc461d6e

Download Submit