fc893e432a67c2fffb7a50d85d25e521563372ec691022283098b1d68e03bc2d

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-30_8c5afd97af59dd0be15d48c4b591ad72_mafia.exe
Size

433KB
MD5

8c5afd97af59dd0be15d48c4b591ad72
SHA1

723970f99977606232f76e746c817292a8150107
SHA256

fc893e432a67c2fffb7a50d85d25e521563372ec691022283098b1d68e03bc2d
SHA512

24a7d2534884e0b194b6f9d35097bba6772e2afa1e23482dc3e6c7285bb28290b21cc17d782a326b8afba195be098bda22759019c292ff49d47a5cdf51100de5
SSDEEP

12288:Ci4g+yU+0pAiv+JD30HzXLk5s/n08Ky/lHxXStsu6dvn:Ci4gXn0pD+BiXuiN

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2792	A64D.tmp

Executes dropped EXE 1 IoCs

pid	Process
2792	A64D.tmp

Loads dropped DLL 1 IoCs

pid	Process
1656	2024-09-30_8c5afd97af59dd0be15d48c4b591ad72_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-30_8c5afd97af59dd0be15d48c4b591ad72_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A64D.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2792	1656	2024-09-30_8c5afd97af59dd0be15d48c4b591ad72_mafia.exe	30
PID 1656 wrote to memory of 2792	1656	2024-09-30_8c5afd97af59dd0be15d48c4b591ad72_mafia.exe	30
PID 1656 wrote to memory of 2792	1656	2024-09-30_8c5afd97af59dd0be15d48c4b591ad72_mafia.exe	30
PID 1656 wrote to memory of 2792	1656	2024-09-30_8c5afd97af59dd0be15d48c4b591ad72_mafia.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-30_8c5afd97af59dd0be15d48c4b591ad72_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-30_8c5afd97af59dd0be15d48c4b591ad72_mafia.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\A64D.tmp
  "C:\Users\Admin\AppData\Local\Temp\A64D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-09-30_8c5afd97af59dd0be15d48c4b591ad72_mafia.exe DB59B42361D9E1EDEB77EAD91A44E9D54AEC884B2AF187EC1E90BDA9A56712BC92AEE1F6CBCB4C75A7DC03D6BFD2EA0DE57A1D28490766A0E469B94CD5EC7EA8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A64D.tmp

Filesize
433KB

MD5
e83f127bc0257f4e4d8063764e578893

SHA1
5cc7ca1a4a15b202253ad049428f5dde86489663

SHA256
c0352bb12e2eed711a198c1063ce1edb28b0ba5baaed6ce0b215e1f058d2c997

SHA512
f14c494d8ff30022fc3b85a490976212c55b43c4f437b4ba9dc88621332e5e1f34315075c4b7a9ff954a88af703aaa2e71e562c369f9d03cf6586371cd33bc4a

Download Submit