2940f85060afe46558e11077cb31cd4961a3552c8f40a3bff5ccd7adb2abf3ef

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe
Size

428KB
MD5

0e3a79e8fe9509ca2113e2bc64b9de2c
SHA1

22da57b0e78a0093e51e7d71595d29685ab4b634
SHA256

2940f85060afe46558e11077cb31cd4961a3552c8f40a3bff5ccd7adb2abf3ef
SHA512

79af6f35697bc345a1b0f54086ecc0a2d5579bb7524a975d2ff5540ba0a3616ec9a005b072630b9757f4a47a6f01aa2785e56239f3cb92b7acd5e28aa20041d4
SSDEEP

6144:+9EyS4oMxIkjxcWqHtg88HPR2Jt6utbvDFfMKXzk6f52hrAwkbzkhpmoDee7:+O4rfItL8HPNEDD5MKXz74lybzkhBV7

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
544	A6EE.tmp

Executes dropped EXE 1 IoCs

pid	Process
544	A6EE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A6EE.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 544	1480	2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe	84
PID 1480 wrote to memory of 544	1480	2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe	84
PID 1480 wrote to memory of 544	1480	2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Local\Temp\A6EE.tmp
  "C:\Users\Admin\AppData\Local\Temp\A6EE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-10-12_0e3a79e8fe9509ca2113e2bc64b9de2c_mafia.exe C02ED7A4C378A545A27113541B9E86EA71930B1552E1F645E0D2D5FEC9E38542937DBDB2E8939721B39BCA0C9D8AE7981F944C1196FA2749F987A72154ABC076
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A6EE.tmp

Filesize
428KB

MD5
9b16004ec1d8e3e306a89fe65fc3ac32

SHA1
e9a8fd5a0da4e2cf28d49bac9b8fe1da6046a15a

SHA256
fc64b3ff0c4ae41b1e975608d04c617cde66894ea43ff57b9d2976edca640a03

SHA512
fa71ce7eafcb9c7c0278f662f763d1f376ae0636ecb96bf671a9c72e036929516c25a58d7637a4bad4623983491ca8682a67b6cdff9a57a445e97cd1b25b3bf3

Download Submit