a2927af5e3b5ab1dea6b1514e510a6646146ac2fce5217ad55a401ccfd8f0d50

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe
Size

536KB
MD5

d086d8c7e6e877dc37ea9a0553e2e1f1
SHA1

ac153ef69f8059ba9664f92e4623a5a156784543
SHA256

a2927af5e3b5ab1dea6b1514e510a6646146ac2fce5217ad55a401ccfd8f0d50
SHA512

bdd5bc2785274077b32dad210b3c40346e081a74a843cb29a7daa42acc98c9fd92d70e7409e91595dfef444b3361e0cdc2306b8240d079c998193f6ae4687b7b
SSDEEP

12288:si4g+yU+0pAiv+p+aKvC6rDyEezj28Igh9F5DMovxUlvjosTdcG93D:si4gXn0pD+pjx6r+K8pr5PmlvjRhF

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2060	D7C9.tmp
2032	2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe

Loads dropped DLL 2 IoCs

pid	Process
1680	2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe
2060	D7C9.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D7C9.tmp

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2060	D7C9.tmp

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2060	1680	2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe	31
PID 1680 wrote to memory of 2060	1680	2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe	31
PID 1680 wrote to memory of 2060	1680	2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe	31
PID 1680 wrote to memory of 2060	1680	2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe	31
PID 2060 wrote to memory of 2032	2060	D7C9.tmp	32
PID 2060 wrote to memory of 2032	2060	D7C9.tmp	32
PID 2060 wrote to memory of 2032	2060	D7C9.tmp	32
PID 2060 wrote to memory of 2032	2060	D7C9.tmp	32

C:\Users\Admin\AppData\Local\Temp\2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\D7C9.tmp
  "C:\Users\Admin\AppData\Local\Temp\D7C9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe E1DB557605F9AFEC0A51918847FAB2829E0865B262513BA62D06A307EB5854C05DCCA27EE0334110CFBE2EC364D4AF98E5B1A55ABA8720C293B6DBF469BC623F
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Users\Admin\AppData\Local\Temp\2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe"
    3⤵
    - Executes dropped EXE
    PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe

Filesize
255KB

MD5
b7fd76103054f562a11ce616d50a0611

SHA1
7473656e5a33b9ecc401985f917f65054bcbd16c

SHA256
aba5c0bff0442597ff8743b4fe7d28de945b78be01eb88fc4a95cadd1fbee409

SHA512
2a2996476dbfdcd50c39c08dc91a179eff4f016013707c9c0972c6e7a0e179b9da4fcff5e2d4d4883a31312bfefdb9a88d1490e1baaa4728a516c5c7f7bdfbd2

Download Submit
\Users\Admin\AppData\Local\Temp\D7C9.tmp

Filesize
536KB

MD5
c8e239da3221c2825fa4d14df0fe1b73

SHA1
af20e3b67851ca43c8d45e2c8343b78bdae81e4d

SHA256
8224a8cbf2afaf646393742064648aae4c13b91f6581baa7be6b85b6ae977e5f

SHA512
cdd64d756845b1d8cbbf284c474c27e2181d9144d1237ed9db8a891395e92245cedae12351e8ad2f838c298e52bafd3cabe2eb73dd036ce42abe2ef01562410d

Download Submit