Overview

overview

7

Static

static

3

2024-10-12...ia.exe

windows7-x64

7

2024-10-12...ia.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-10-2024 04:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-12_80ab2e561a9ff4c074361fb4abb43c70_mafia.exe

  • Size

    428KB

  • MD5

    80ab2e561a9ff4c074361fb4abb43c70

  • SHA1

    4403969f6362ad1eb4836e3ce17c93ed786dde9d

  • SHA256

    bd07f2ee26c8f8ec66362c39eb36dc0e6d6020aef14b385bd38180d2ec2f25c0

  • SHA512

    098b00118284401683b964cb8ce6543abb8476b9cd3230ece2e2bbd2bc3ca931dde4bbb156cc6322ad5172479234d72465348cd84e5469257020eee84150f155

  • SSDEEP

    6144:gVdvczEb7GUOpYWhNVynE/mFVp5UJ2EQ0l2opY2c+1xrmeTWH5Pqu3qHR:gZLolhNVyEUCh2M7mM+hN3qHR

Score
7/10
discovery

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-12_80ab2e561a9ff4c074361fb4abb43c70_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-12_80ab2e561a9ff4c074361fb4abb43c70_mafia.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Users\Admin\AppData\Local\Temp\D153.tmp
      "C:\Users\Admin\AppData\Local\Temp\D153.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-10-12_80ab2e561a9ff4c074361fb4abb43c70_mafia.exe AF7CFDFB203A7AC4A809817DF586F66EEEF850919573B60312C2EB25329DD2B4C1E81A6948C22B5F1592B6A24D366347924C2A83C622D02B7113EE9B943C0067
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:2044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\D153.tmp
    Filesize

    428KB

    MD5

    df66aafa04d17844c5a072107ad2a819

    SHA1

    02107252aebca795b14a6843921ef9dbbb11c769

    SHA256

    ed08667a9977d0ad28d6a1b25591488e0fa3643e73ab1c91f6e5095872628d7e

    SHA512

    e85791b3ec68ec9592b3a11163ad654f9ea9798351955bb58d33f9d7ebd6f484ecd50da4d839672f2ca99e1bae2b8bd3cb44504ce51dd4812e361a3f5c2364d6

    Download Submit