Overview

overview

7

Static

static

3

2024-10-05...ia.exe

windows7-x64

7

2024-10-05...ia.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05-10-2024 03:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-05_0f846438c0f82f758e26a527da613673_mafia.exe

  • Size

    412KB

  • MD5

    0f846438c0f82f758e26a527da613673

  • SHA1

    df2429104d5cccd48b85c3554dc88d1be6209254

  • SHA256

    92d382e9dbe9e4438b0a35f8958ecbaf9f39988544059cbb1f023ac300a54dcc

  • SHA512

    c8c4cbd12ac0e744c5931b6c9b2194345323dd3ffa86597966df7ebe31736559737ab73065eecefb231861131f0d9db6fa4dac0f5a5121db9e713be99e5daf21

  • SSDEEP

    12288:U6PCrIc9kph5g7yAWEISH4xfXvL0Xd/I5VeUdj:U6QIcOh5iWQOfz0X

Score
7/10
discovery

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-05_0f846438c0f82f758e26a527da613673_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-05_0f846438c0f82f758e26a527da613673_mafia.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Users\Admin\AppData\Local\Temp\EF10.tmp
      "C:\Users\Admin\AppData\Local\Temp\EF10.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-10-05_0f846438c0f82f758e26a527da613673_mafia.exe 914E6414F3AAFAE268DD9DE68E0D8B92B198442CD48081D1C70BF56D0CA2F963DC7B4E6A016781AC380538634C543237A63FFFD32BAA7EF54C0B1B8F9DC08012
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:2272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\EF10.tmp
    Filesize

    412KB

    MD5

    0a9d4f8e13bc41c14d63b5c7f99682d6

    SHA1

    4ad83252c184db5eedbbc23e131ad5d37cf86e98

    SHA256

    a3fca48d3f0bc9f4ccf241407abd3126a86640f30ca8da4a98e6c3cc97608532

    SHA512

    35eb8be7b78577677fe920719b76fda53d2168b03dae854e5b5c6598ebea7524ef893fe32087837342e5de5f00e56772f09ca777d1d431beaedacb11a4e183eb

    Download Submit