Malware Analysis Report

2024-10-19 01:52

Sample ID 240830-2spaps1emk
Target 2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia
SHA256 8ce486ceb12f06bb549a6d2ee456e0805f5019e4a35313bce08c6f36b7608177
Tags
tofsee discovery evasion execution persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8ce486ceb12f06bb549a6d2ee456e0805f5019e4a35313bce08c6f36b7608177

Threat Level: Known bad

The file 2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia was found to be: Known bad.

Malicious Activity Summary

tofsee discovery evasion execution persistence privilege_escalation trojan

Tofsee

Windows security bypass

Creates new service(s)

Sets service image path in registry

Modifies Windows Firewall

Executes dropped EXE

Checks computer location settings

Deletes itself

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

System Location Discovery: System Language Discovery

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-30 22:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-30 22:50

Reported

2024-08-30 22:53

Platform

win7-20240729-en

Max time kernel

149s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\kwbargbi = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\kwbargbi\ImagePath = "C:\\Windows\\SysWOW64\\kwbargbi\\dfaricjc.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\kwbargbi\dfaricjc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 296 set thread context of 2364 N/A C:\Windows\SysWOW64\kwbargbi\dfaricjc.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\kwbargbi\dfaricjc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 628 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 628 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 628 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 628 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 628 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 628 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 628 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 628 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 628 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 628 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 628 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 628 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 296 wrote to memory of 2364 N/A C:\Windows\SysWOW64\kwbargbi\dfaricjc.exe C:\Windows\SysWOW64\svchost.exe
PID 296 wrote to memory of 2364 N/A C:\Windows\SysWOW64\kwbargbi\dfaricjc.exe C:\Windows\SysWOW64\svchost.exe
PID 296 wrote to memory of 2364 N/A C:\Windows\SysWOW64\kwbargbi\dfaricjc.exe C:\Windows\SysWOW64\svchost.exe
PID 296 wrote to memory of 2364 N/A C:\Windows\SysWOW64\kwbargbi\dfaricjc.exe C:\Windows\SysWOW64\svchost.exe
PID 296 wrote to memory of 2364 N/A C:\Windows\SysWOW64\kwbargbi\dfaricjc.exe C:\Windows\SysWOW64\svchost.exe
PID 296 wrote to memory of 2364 N/A C:\Windows\SysWOW64\kwbargbi\dfaricjc.exe C:\Windows\SysWOW64\svchost.exe
PID 628 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\netsh.exe
PID 628 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\netsh.exe
PID 628 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\netsh.exe
PID 628 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe

"C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kwbargbi\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dfaricjc.exe" C:\Windows\SysWOW64\kwbargbi\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create kwbargbi binPath= "C:\Windows\SysWOW64\kwbargbi\dfaricjc.exe /d\"C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description kwbargbi "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start kwbargbi

C:\Windows\SysWOW64\kwbargbi\dfaricjc.exe

C:\Windows\SysWOW64\kwbargbi\dfaricjc.exe /d"C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.236.44.162:80 microsoft.com tcp
AU 43.231.4.7:443 tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.11.0:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.228.94:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 142.250.153.26:25 smtp.google.com tcp
AU 43.231.4.7:443 tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
AU 43.231.4.7:443 tcp

Files

memory/628-1-0x0000000000230000-0x0000000000330000-memory.dmp

memory/628-2-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dfaricjc.exe

MD5 df03e9b89b407af88ae04c6f006b52f5
SHA1 29a75eac5cd2e67b9d10b057c35c4a5be66249d3
SHA256 9e28544ff3df937db1973d722b2162b8e8158aee234e537563287652567160bb
SHA512 d543141d06f3e3adeca3df1ba28f8e395fdc08fd468dd04673d7ed9fa36610381c2299d6fc21094f1412819e24919d2e7cb4cea693c15105f2fe7bcb381c62eb

memory/2364-10-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2364-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2364-7-0x0000000000080000-0x0000000000095000-memory.dmp

memory/296-11-0x0000000000400000-0x000000000051A000-memory.dmp

memory/628-14-0x0000000000400000-0x0000000000415000-memory.dmp

memory/628-13-0x0000000000400000-0x000000000051A000-memory.dmp

memory/2364-15-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2364-16-0x0000000000080000-0x0000000000095000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-30 22:50

Reported

2024-08-30 22:53

Platform

win10v2004-20240802-en

Max time kernel

146s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ddbbmkhb\ImagePath = "C:\\Windows\\SysWOW64\\ddbbmkhb\\idkhgdza.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ddbbmkhb\idkhgdza.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4460 set thread context of 3988 N/A C:\Windows\SysWOW64\ddbbmkhb\idkhgdza.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ddbbmkhb\idkhgdza.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3272 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\cmd.exe
PID 3272 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\cmd.exe
PID 3272 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\cmd.exe
PID 3272 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\cmd.exe
PID 3272 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\cmd.exe
PID 3272 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\cmd.exe
PID 3272 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 3272 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 3272 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 3272 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 3272 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 3272 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 3272 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 3272 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 3272 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\sc.exe
PID 3272 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\netsh.exe
PID 3272 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\netsh.exe
PID 3272 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe C:\Windows\SysWOW64\netsh.exe
PID 4460 wrote to memory of 3988 N/A C:\Windows\SysWOW64\ddbbmkhb\idkhgdza.exe C:\Windows\SysWOW64\svchost.exe
PID 4460 wrote to memory of 3988 N/A C:\Windows\SysWOW64\ddbbmkhb\idkhgdza.exe C:\Windows\SysWOW64\svchost.exe
PID 4460 wrote to memory of 3988 N/A C:\Windows\SysWOW64\ddbbmkhb\idkhgdza.exe C:\Windows\SysWOW64\svchost.exe
PID 4460 wrote to memory of 3988 N/A C:\Windows\SysWOW64\ddbbmkhb\idkhgdza.exe C:\Windows\SysWOW64\svchost.exe
PID 4460 wrote to memory of 3988 N/A C:\Windows\SysWOW64\ddbbmkhb\idkhgdza.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe

"C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ddbbmkhb\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\idkhgdza.exe" C:\Windows\SysWOW64\ddbbmkhb\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create ddbbmkhb binPath= "C:\Windows\SysWOW64\ddbbmkhb\idkhgdza.exe /d\"C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description ddbbmkhb "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start ddbbmkhb

C:\Windows\SysWOW64\ddbbmkhb\idkhgdza.exe

C:\Windows\SysWOW64\ddbbmkhb\idkhgdza.exe /d"C:\Users\Admin\AppData\Local\Temp\2024-08-30_72eacd8c0200a968c6a409622545fc23_mafia.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
NL 20.76.201.171:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.42.0:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 171.201.76.20.in-addr.arpa udp
AU 43.231.4.7:443 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.204.79:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 43.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 142.250.153.26:25 smtp.google.com tcp
AU 43.231.4.7:443 tcp
US 8.8.8.8:53 42.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
AU 43.231.4.7:443 tcp

Files

memory/3272-1-0x0000000000760000-0x0000000000860000-memory.dmp

memory/3272-2-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\idkhgdza.exe

MD5 af3476f2e4789d3e20c91ee1c74ffd85
SHA1 6376961d67dc694f1841a2a9e451c18d4ce01171
SHA256 058288b0127106e3cbe22a494442e9f9d8bb3947f19a5b3e44974f05066ff2cb
SHA512 a6ac34899ef39cfff22b638585157cbce9a5ffa8b4f84864010060341b45b06ec360ab892e839e7087e1181d5d32d1657e088067abc6f561328b9f5d29a4aa80

memory/3272-7-0x0000000000400000-0x0000000000415000-memory.dmp

memory/3272-6-0x0000000000400000-0x000000000051A000-memory.dmp

memory/4460-9-0x0000000000400000-0x000000000051A000-memory.dmp

memory/4460-10-0x0000000000400000-0x000000000051A000-memory.dmp

memory/3988-11-0x00000000009E0000-0x00000000009F5000-memory.dmp

memory/3988-13-0x00000000009E0000-0x00000000009F5000-memory.dmp

memory/4460-15-0x0000000000400000-0x000000000051A000-memory.dmp

memory/3988-16-0x00000000009E0000-0x00000000009F5000-memory.dmp