Overview

overview

7

Static

static

3

2024-10-12...ia.exe

windows7-x64

7

2024-10-12...ia.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2024 04:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-12_80ab2e561a9ff4c074361fb4abb43c70_mafia.exe

  • Size

    428KB

  • MD5

    80ab2e561a9ff4c074361fb4abb43c70

  • SHA1

    4403969f6362ad1eb4836e3ce17c93ed786dde9d

  • SHA256

    bd07f2ee26c8f8ec66362c39eb36dc0e6d6020aef14b385bd38180d2ec2f25c0

  • SHA512

    098b00118284401683b964cb8ce6543abb8476b9cd3230ece2e2bbd2bc3ca931dde4bbb156cc6322ad5172479234d72465348cd84e5469257020eee84150f155

  • SSDEEP

    6144:gVdvczEb7GUOpYWhNVynE/mFVp5UJ2EQ0l2opY2c+1xrmeTWH5Pqu3qHR:gZLolhNVyEUCh2M7mM+hN3qHR

Score
7/10
discovery

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-12_80ab2e561a9ff4c074361fb4abb43c70_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-12_80ab2e561a9ff4c074361fb4abb43c70_mafia.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Users\Admin\AppData\Local\Temp\B16E.tmp
      "C:\Users\Admin\AppData\Local\Temp\B16E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-10-12_80ab2e561a9ff4c074361fb4abb43c70_mafia.exe C291981DD85F9AB6824CC7526185D06A1BF69B691AC282C6CB3EEC52B0C5C6080B5C2D14869E03EB2776854DF6B615A9260E6989DADCFB37CC029ED1A6237065
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:3764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\B16E.tmp
    Filesize

    428KB

    MD5

    a2c8bda3570879d879b9b2cc2a11f879

    SHA1

    b64309919cecdcb7df9274fcb09610ed02ea0d10

    SHA256

    dbdb19d850cdc8e58fbd28872a4d663baf8895c34e59a894e7283cb82ec4a8ad

    SHA512

    95b781cd08cd53e40cdbd77e219f4a9b07e93873c03fde2c69000cf82a3da5604affcc7010fc66bcf56642197d88421d24275edd82a2c4a22df1702676854165

    Download Submit