f986393d3dd17e3095c08b4a6393c14e37c4ea204040b96f3b31c035c5d4b0d7

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-09-08_21377c1762af5b4d05ea9f2b93c1f50f_mafia.exe
Size

1019KB
MD5

21377c1762af5b4d05ea9f2b93c1f50f
SHA1

17e4ba161c7d4e18e8abee02fcbddef496cfcf15
SHA256

f986393d3dd17e3095c08b4a6393c14e37c4ea204040b96f3b31c035c5d4b0d7
SHA512

a3bdb2d0de7e8129d4d643a81b66050bc22025384aa2618fac74895f8649fee9696eea498614f7cb37ac661a32970fe0e13b84d5cbcc62370f494fd81acc39ef
SSDEEP

24576:2pXgJRn45/PIr9oPicxHEHvFb282ecMlyBP/2tTM+L:2pXgS3IyPicFiFV2ecMl5TMW

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\dot3svc\Parameters\ServiceDll = "%SystemRoot%\\system32\\Lscsvc.dll"	2024-09-08_21377c1762af5b4d05ea9f2b93c1f50f_mafia.exe

Deletes itself 1 IoCs

pid	Process
2168	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lscsvc.dll	2024-09-08_21377c1762af5b4d05ea9f2b93c1f50f_mafia.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Lscsvc32.dll	2024-09-08_21377c1762af5b4d05ea9f2b93c1f50f_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-08_21377c1762af5b4d05ea9f2b93c1f50f_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 2168	1348	2024-09-08_21377c1762af5b4d05ea9f2b93c1f50f_mafia.exe	30
PID 1348 wrote to memory of 2168	1348	2024-09-08_21377c1762af5b4d05ea9f2b93c1f50f_mafia.exe	30
PID 1348 wrote to memory of 2168	1348	2024-09-08_21377c1762af5b4d05ea9f2b93c1f50f_mafia.exe	30
PID 1348 wrote to memory of 2168	1348	2024-09-08_21377c1762af5b4d05ea9f2b93c1f50f_mafia.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-08_21377c1762af5b4d05ea9f2b93c1f50f_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-08_21377c1762af5b4d05ea9f2b93c1f50f_mafia.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_delself_.bat"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_delself_.bat

Filesize
217B

MD5
e59fb573288c036529fcd0423d78892c

SHA1
65f05f6244d5f238243b0ab6c44ec14703a0bc77

SHA256
ce35a73276a556aaf4e0055107356ed3105105509c1738196b7dce77b1f378d8

SHA512
e49ac220927db73fbabff6e7fd9ef9c4acc3625207290a4ac2656cc730b68cf2b020b55278d68db3ea7a2451f809a199390bbe589dd93ad35663772439df346c

Download Submit
memory/1348-0-0x00000000009E0000-0x0000000000B0F000-memory.dmp

Filesize
1.2MB

Download
memory/1348-4-0x00000000009E0000-0x0000000000B0F000-memory.dmp

Filesize
1.2MB

Download