77d7dc0d3094da0e9d4e5d002d946f005121326297af66ae480414f86d00dd2f

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe
Size

414KB
MD5

e0207c5f11f53bc874c28e9d835dca16
SHA1

93802b903c251bf0a7d88be6fc0d3504f5159c30
SHA256

77d7dc0d3094da0e9d4e5d002d946f005121326297af66ae480414f86d00dd2f
SHA512

a23e0102020a7e6eebc1dae4ca60bfcfffefe2f5e62608624cc86c821f2846e3f57855cd869c515b4c340fa03887fc6e5374f0539c2bcb7aaacd1982829c1382
SSDEEP

6144:Wucyz4obQmKkWb6ekie+ogU6BY0z6NtxYnUNVgwIJOE4WXsIjnj1qxzR+dMTlx:Wq4w/ekieZgU67WlYncpYLkxYd+lx

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3352	8CFE.tmp

Executes dropped EXE 1 IoCs

pid	Process
3352	8CFE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8CFE.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 3352	908	2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe	84
PID 908 wrote to memory of 3352	908	2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe	84
PID 908 wrote to memory of 3352	908	2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\8CFE.tmp
  "C:\Users\Admin\AppData\Local\Temp\8CFE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-08-29_e0207c5f11f53bc874c28e9d835dca16_mafia.exe 2B8E15D2B1B70DE82FAE453FA3D20446C0CA63494DFF5EB2A7ECDFC1EC0645F8CFB8CE60C7AA79C840830244D30885F8D5CEF768EC11D96EBDB2859C9CA60327
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8CFE.tmp

Filesize
414KB

MD5
50df75a353c8bafa33d6e4e25dd8015f

SHA1
8c8ffac3c28ac137a17f93bae70b78fde9b59351

SHA256
987458bae810273aad2c377d606fbd31ff09b8688825979a375b43cff84e0ebf

SHA512
90f3caacbe709bfc621e052b1a540cb7a19ab8820ffdd884ba8e45e558800b27f8f7935faf611f6bf9865c926ecbd4c7bd7545192f698b6fd2961ac9ecce3802

Download Submit