Overview

overview

7

Static

static

3

2024-09-19...ia.exe

windows7-x64

7

2024-09-19...ia.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    94s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 12:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-19_0db29a26c6dbffae4210e57955259e51_mafia.exe

  • Size

    428KB

  • MD5

    0db29a26c6dbffae4210e57955259e51

  • SHA1

    da7623d1526cbe31d432e1d0617b1b2b85b7404a

  • SHA256

    9b487d7c8d6578771c604aa76ea0f1740828cb102bbbf35c179f7bf3c8fe8305

  • SHA512

    995549825722b3d05508f8e00e4bc4cb1b2e29d7254461670df84f0bd654596bac6529332b1c7085c1cf9b9b24ff4554cb6208512e88fc5555c5bc1fb555d75e

  • SSDEEP

    6144:gVdvczEb7GUOpYWhNVynE/mF/g5FaPzR5rw2mi0U2BbkzPjp7Dy9qHR:gZLolhNVyEuPzRBwq0/BbIjp+qHR

Score
7/10
discovery

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-19_0db29a26c6dbffae4210e57955259e51_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-19_0db29a26c6dbffae4210e57955259e51_mafia.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Users\Admin\AppData\Local\Temp\A095.tmp
      "C:\Users\Admin\AppData\Local\Temp\A095.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-09-19_0db29a26c6dbffae4210e57955259e51_mafia.exe D1EFFE67B0004F13242761B0D40962D070352CCA194557460C27EF257DC77150C38DB71689169870E179CD7CB61476ECC999D2BC5291A647F03458D626C483CB
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:464

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\A095.tmp
          Filesize

          428KB

          MD5

          0d42579db3f3bea1a7d0c209bbfd31ff

          SHA1

          cfb80474fb8277e21c70f88df276390c290bbd8d

          SHA256

          d8c79cb6c6c7df187aa43dc611174df200c75a2a07d35a334916f7ba5aa71abb

          SHA512

          5154a1b1b103ba21330ae08a701b69f36e642ba37644e003ecd767fe11d88b498275e0f6130d3f864b7fed1edc723bc2984f6d288a46a3c1e68de6b8235e20af

          Download Submit