Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 08:40
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe
-
Size
536KB
-
MD5
d086d8c7e6e877dc37ea9a0553e2e1f1
-
SHA1
ac153ef69f8059ba9664f92e4623a5a156784543
-
SHA256
a2927af5e3b5ab1dea6b1514e510a6646146ac2fce5217ad55a401ccfd8f0d50
-
SHA512
bdd5bc2785274077b32dad210b3c40346e081a74a843cb29a7daa42acc98c9fd92d70e7409e91595dfef444b3361e0cdc2306b8240d079c998193f6ae4687b7b
-
SSDEEP
12288:si4g+yU+0pAiv+p+aKvC6rDyEezj28Igh9F5DMovxUlvjosTdcG93D:si4gXn0pD+pjx6r+K8pr5PmlvjRhF
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation 6A72.tmp -
Executes dropped EXE 2 IoCs
pid Process 208 6A72.tmp 4140 2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 208 6A72.tmp -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4912 wrote to memory of 208 4912 2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe 82 PID 4912 wrote to memory of 208 4912 2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe 82 PID 4912 wrote to memory of 208 4912 2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe 82 PID 208 wrote to memory of 4140 208 6A72.tmp 83 PID 208 wrote to memory of 4140 208 6A72.tmp 83 PID 208 wrote to memory of 4140 208 6A72.tmp 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe 2377945340732123A4AAA6E3C182B9BEEE3449CBDD4CD722B6D853AAABE9BE89FC448279558145EAC44C34BD2CED043ED5D9FD811E9261D364CBDA8AD71401F62⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-29_d086d8c7e6e877dc37ea9a0553e2e1f1_mafia.exe"3⤵
- Executes dropped EXE
PID:4140
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5b7fd76103054f562a11ce616d50a0611
SHA17473656e5a33b9ecc401985f917f65054bcbd16c
SHA256aba5c0bff0442597ff8743b4fe7d28de945b78be01eb88fc4a95cadd1fbee409
SHA5122a2996476dbfdcd50c39c08dc91a179eff4f016013707c9c0972c6e7a0e179b9da4fcff5e2d4d4883a31312bfefdb9a88d1490e1baaa4728a516c5c7f7bdfbd2
-
Filesize
536KB
MD54fe4a54fabc75b1bdc5c37dfd5faab12
SHA1315a436e43592299178cf3d63020c556b22107c7
SHA25662b79784048bcc6b18e2b129063b83d96128591548e91a81572ded9b97843b05
SHA512cfe7513ba6dadf72467acecd9bc505c1aa223f28c53435b73a7443379680a08f64819b01e6a59a6206a561f1ec0664ebf19587c34387bdf09a75a59883e6371f