a305f9d281829dec5f6a110cd0d985387c3e2fedf50c7c1ad553f4e5aa56118f

Analysis

max time kernel
93s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-01_261e8ac5e72652d17bacc5f202869e15_mafia.exe
Size

428KB
MD5

261e8ac5e72652d17bacc5f202869e15
SHA1

a3355325f594ab59ac6c7139c775e50a2c8a7e05
SHA256

a305f9d281829dec5f6a110cd0d985387c3e2fedf50c7c1ad553f4e5aa56118f
SHA512

fc71a9aabd24aabf53b5b650358a98a9bd40eb6ebeac1b3bc9504ab078fac6237aae687335c7e17b5e624e7a3265947e2428b6497fd45faeccbefeb89f0b2ee1
SSDEEP

12288:+O4rfItL8HPpzj8zAsxTdeFnl3TfWNhy7:+O4rQtGPecsx5eFl3r4y

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2380	81D2.tmp

Executes dropped EXE 1 IoCs

pid	Process
2380	81D2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-01_261e8ac5e72652d17bacc5f202869e15_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81D2.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 2380	4924	2024-10-01_261e8ac5e72652d17bacc5f202869e15_mafia.exe	82
PID 4924 wrote to memory of 2380	4924	2024-10-01_261e8ac5e72652d17bacc5f202869e15_mafia.exe	82
PID 4924 wrote to memory of 2380	4924	2024-10-01_261e8ac5e72652d17bacc5f202869e15_mafia.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-10-01_261e8ac5e72652d17bacc5f202869e15_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-01_261e8ac5e72652d17bacc5f202869e15_mafia.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\81D2.tmp
  "C:\Users\Admin\AppData\Local\Temp\81D2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-10-01_261e8ac5e72652d17bacc5f202869e15_mafia.exe D3DA60EC7385C1430F6BE36E715AE5A231C5015579CB4A4EA828BF0DD900C612915CE2A29E2BAFD691CA28D8DBA333FF570499769D72AA3B5E735E32FA060A05
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81D2.tmp

Filesize
428KB

MD5
9b436434db8d828845edbc428a21acdb

SHA1
803c798ebc0338082b70a8a533efac45f4d6043f

SHA256
bfabf0faedb69e60ca01695cd5e57390c86d67684c59c87ea9023db4f803a654

SHA512
fa8c047a2726b290e244fcd8ecaa4cd86fc80dbcea811ea4e6b6c29fdc927b5a625fd474b5693c6e99589a30431ef7a49d9f49ed62c30e311d8b728b9fc3308d

Download Submit