2940f85060afe46558e11077cb31cd4961a3552c8f40a3bff5ccd7adb2abf3ef

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe
Size

428KB
MD5

0e3a79e8fe9509ca2113e2bc64b9de2c
SHA1

22da57b0e78a0093e51e7d71595d29685ab4b634
SHA256

2940f85060afe46558e11077cb31cd4961a3552c8f40a3bff5ccd7adb2abf3ef
SHA512

79af6f35697bc345a1b0f54086ecc0a2d5579bb7524a975d2ff5540ba0a3616ec9a005b072630b9757f4a47a6f01aa2785e56239f3cb92b7acd5e28aa20041d4
SSDEEP

6144:+9EyS4oMxIkjxcWqHtg88HPR2Jt6utbvDFfMKXzk6f52hrAwkbzkhpmoDee7:+O4rfItL8HPNEDD5MKXz74lybzkhBV7

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2352	761A.tmp

Executes dropped EXE 1 IoCs

pid	Process
2352	761A.tmp

Loads dropped DLL 1 IoCs

pid	Process
2900	2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	761A.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2352	2900	2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe	30
PID 2900 wrote to memory of 2352	2900	2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe	30
PID 2900 wrote to memory of 2352	2900	2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe	30
PID 2900 wrote to memory of 2352	2900	2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\761A.tmp
  "C:\Users\Admin\AppData\Local\Temp\761A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe 325D779D55BA68F0231AD39120CF3C9333E4D9DDFDE3D8D7AC656E7AFE3997D8536FC488D714FF2BA3D2217C9798F98ACF3A2ED5382F3A4401F172F14D902B5F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\761A.tmp

Filesize
428KB

MD5
1cb4ddff70d29552a8d4f4956e6832f1

SHA1
91048d771faa9d298c1398a6ea71de0808ec7f93

SHA256
7f0fb3274b9868d9823c61ad4155393f2a6654454848405bfdec3960a0737618

SHA512
b939884362474d992cac1dfe1b5f6dad6b8e4610a6fa532b925d88a03ca8e7cc171d77af36b2b2364ac8a3bd963c43e555cc54ac95638cfaf3a72406e995f090

Download Submit