Overview

overview

7

Static

static

3

2024-10-05...ia.exe

windows7-x64

7

2024-10-05...ia.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-10-2024 03:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-05_0f846438c0f82f758e26a527da613673_mafia.exe

  • Size

    412KB

  • MD5

    0f846438c0f82f758e26a527da613673

  • SHA1

    df2429104d5cccd48b85c3554dc88d1be6209254

  • SHA256

    92d382e9dbe9e4438b0a35f8958ecbaf9f39988544059cbb1f023ac300a54dcc

  • SHA512

    c8c4cbd12ac0e744c5931b6c9b2194345323dd3ffa86597966df7ebe31736559737ab73065eecefb231861131f0d9db6fa4dac0f5a5121db9e713be99e5daf21

  • SSDEEP

    12288:U6PCrIc9kph5g7yAWEISH4xfXvL0Xd/I5VeUdj:U6QIcOh5iWQOfz0X

Score
7/10
discovery

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-05_0f846438c0f82f758e26a527da613673_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-05_0f846438c0f82f758e26a527da613673_mafia.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3496
    • C:\Users\Admin\AppData\Local\Temp\82AD.tmp
      "C:\Users\Admin\AppData\Local\Temp\82AD.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-10-05_0f846438c0f82f758e26a527da613673_mafia.exe F72DE9D68E292D85D19793B807049BDE72CA4C973EDB8991E9FED49D3CDE9D9CA6C32AF4439906A16427B50D5C055458BA63DAAD8E4CF2C715878B5D5792A369
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:1508

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\82AD.tmp
    Filesize

    412KB

    MD5

    6f214896b13f44869695655d1b7c36dd

    SHA1

    f2cf5f2288284ffbb1dad257c3e4f916e593a94a

    SHA256

    44f7f3c2ff6b3824edf521534a9bf7d1acd32c734897d8f11098a849de799c32

    SHA512

    a602203c59161b0142180c0fc77e9b16fe5c2df5743fdc4a940aab167e4dcbeb91469efcaea9e716b0aaf1da02a5e78a0c3d25040fd60c9b1fdc7270808b2f59

    Download Submit