5f23d51627bd95f65d6078bfd033c8e65f2257bacc87ef5a89458044cc886724

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-08_433e18bbd4824a7de9cf4792ae78382a_mafia.exe
Size

1018KB
MD5

433e18bbd4824a7de9cf4792ae78382a
SHA1

e269575c789e1c92f85b7c087eb2604106c3c3d8
SHA256

5f23d51627bd95f65d6078bfd033c8e65f2257bacc87ef5a89458044cc886724
SHA512

b01091796de38731cdfdceb2c6db6423e45cd6944aa2a8f5a29fb2393bd815edf4ef269e7e34353b936689bf1538c69d3ec29d29f55d4129725e356bd0c27446
SSDEEP

24576:/pXgJRn45/PIr9oPicgHEHvFb282ecMlyBP/2tTM+s:/pXgS3IyPicAiFV2ecMl5TMt

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\dot3svc\Parameters\ServiceDll = "%SystemRoot%\\system32\\Lscsvc.dll"	2024-09-08_433e18bbd4824a7de9cf4792ae78382a_mafia.exe

Deletes itself 1 IoCs

pid	Process
2972	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lscsvc.dll	2024-09-08_433e18bbd4824a7de9cf4792ae78382a_mafia.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Lscsvc32.dll	2024-09-08_433e18bbd4824a7de9cf4792ae78382a_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-08_433e18bbd4824a7de9cf4792ae78382a_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2972	1296	2024-09-08_433e18bbd4824a7de9cf4792ae78382a_mafia.exe	30
PID 1296 wrote to memory of 2972	1296	2024-09-08_433e18bbd4824a7de9cf4792ae78382a_mafia.exe	30
PID 1296 wrote to memory of 2972	1296	2024-09-08_433e18bbd4824a7de9cf4792ae78382a_mafia.exe	30
PID 1296 wrote to memory of 2972	1296	2024-09-08_433e18bbd4824a7de9cf4792ae78382a_mafia.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-08_433e18bbd4824a7de9cf4792ae78382a_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-08_433e18bbd4824a7de9cf4792ae78382a_mafia.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_delself_.bat"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_delself_.bat

Filesize
217B

MD5
fbd3404527fc9487649626b9a69032b3

SHA1
b376f59a0eb747d671ebe98ff822df233849951f

SHA256
41f3b399dd3ce3338c153278b016e48686ce92d101a6910494bc5b9c43652eb9

SHA512
67ed1e6174d6fa9ffe1535eb6e75ca1ddc6e91b6eb37709c109a47a5c3ac9c171b5923ae9ec46411419b56f13195a5a38e9d8e9262ea548ac8fb0bc51a705f59

Download Submit
memory/1296-0-0x0000000000900000-0x0000000000A2F000-memory.dmp

Filesize
1.2MB

Download
memory/1296-4-0x0000000000900000-0x0000000000A2F000-memory.dmp

Filesize
1.2MB

Download