Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 01:26
Behavioral task
behavioral1
Sample
2024-12-10_1a9b310034f8c3838ae27e437a20e734_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-12-10_1a9b310034f8c3838ae27e437a20e734_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-12-10_1a9b310034f8c3838ae27e437a20e734_mafia.exe
-
Size
291KB
-
MD5
1a9b310034f8c3838ae27e437a20e734
-
SHA1
209b4a85938036e0bd172e51796ca26ff4c300ef
-
SHA256
794647c8f024349d6a97bc749010536a19fa69a88343cbf03588cabfd84f7b67
-
SHA512
c295f1bd73966e96654010e2e8ea9ad56b64c8bb1e1738b86daf98c665418be471bb5c36637aa1c10215c2a65c83268b9d9679dc1bccd46a2ce1712d95bb4e19
-
SSDEEP
6144:e1ePsPFKYLSCwZJOcUoSSwu5To9X08n3LD9GqBDVUrhOHkz3lKqfcU8:e0kPFzIOcUoSSwu5To9XvLD9pBDVU0kX
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-10_1a9b310034f8c3838ae27e437a20e734_mafia.exe
Processes
Network
-
Remote address:8.8.8.8:53Requestt.meIN AResponset.meIN A149.154.167.99
-
Remote address:149.154.167.99:443RequestGET /asifrazatg HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0;x64 rv:107.0) Gecko / 20100101 Firefox / 107.0
Host: t.me
ResponseHTTP/1.1 200 OK
Date: Tue, 10 Dec 2024 01:27:01 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 9594
Connection: keep-alive
Set-Cookie: stel_ssid=4475b5d5e81064ff25_9424328249742091850; expires=Wed, 11 Dec 2024 01:27:01 GMT; path=/; samesite=None; secure; HttpOnly
Pragma: no-cache
Cache-control: no-store
X-Frame-Options: ALLOW-FROM https://web.telegram.org
Content-Security-Policy: frame-ancestors https://web.telegram.org
Strict-Transport-Security: max-age=35768000
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Requeststeamcommunity.comIN AResponsesteamcommunity.comIN A104.82.234.109
-
GEThttps://steamcommunity.com/profiles/765611994399296692024-12-10_1a9b310034f8c3838ae27e437a20e734_mafia.exeRemote address:104.82.234.109:443RequestGET /profiles/76561199439929669 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0;x64 rv:107.0) Gecko / 20100101 Firefox / 107.0
Host: steamcommunity.com
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Date: Tue, 10 Dec 2024 01:27:02 GMT
Content-Length: 35669
Connection: keep-alive
Set-Cookie: sessionid=59ee2074b84732d0325eb737; Path=/; Secure; SameSite=None
Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request99.167.154.149.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request134.130.81.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request41.249.124.192.in-addr.arpaIN PTRResponse41.249.124.192.in-addr.arpaIN PTRcloudproxy10041sucurinet
-
Remote address:195.201.45.53:80RequestGET /1148 HTTP/1.1
Host: 195.201.45.53
ResponseHTTP/1.1 301 Moved Permanently
Date: Tue, 10 Dec 2024 01:27:02 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://solr.kennstdueinen.de/1148
-
Remote address:8.8.8.8:53Requestsolr.kennstdueinen.deIN AResponsesolr.kennstdueinen.deIN A195.201.45.53
-
Remote address:195.201.45.53:443RequestGET /1148 HTTP/1.1
Host: solr.kennstdueinen.de
Connection: Keep-Alive
ResponseHTTP/1.1 403 Forbidden
Date: Tue, 10 Dec 2024 01:27:03 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
-
Remote address:8.8.8.8:53Request109.234.82.104.in-addr.arpaIN PTRResponse109.234.82.104.in-addr.arpaIN PTRa104-82-234-109deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request75.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request53.45.201.195.in-addr.arpaIN PTRResponse53.45.201.195.in-addr.arpaIN PTRsolr kennstdueinende
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request180.129.81.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:149.154.167.99:443RequestGET /asifrazatg HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0;x64 rv:107.0) Gecko / 20100101 Firefox / 107.0
Host: t.me
Cookie: stel_ssid=4475b5d5e81064ff25_9424328249742091850
ResponseHTTP/1.1 200 OK
Date: Tue, 10 Dec 2024 01:29:24 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 9594
Connection: keep-alive
Pragma: no-cache
Cache-control: no-store
X-Frame-Options: ALLOW-FROM https://web.telegram.org
Content-Security-Policy: frame-ancestors https://web.telegram.org
Strict-Transport-Security: max-age=35768000
-
GEThttps://steamcommunity.com/profiles/765611994399296692024-12-10_1a9b310034f8c3838ae27e437a20e734_mafia.exeRemote address:104.82.234.109:443RequestGET /profiles/76561199439929669 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0;x64 rv:107.0) Gecko / 20100101 Firefox / 107.0
Host: steamcommunity.com
Cookie: sessionid=59ee2074b84732d0325eb737; steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Date: Tue, 10 Dec 2024 01:29:24 GMT
Content-Length: 35669
Connection: keep-alive
-
Remote address:195.201.45.53:80RequestGET /1148 HTTP/1.1
Host: 195.201.45.53
ResponseHTTP/1.1 301 Moved Permanently
Date: Tue, 10 Dec 2024 01:29:25 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://solr.kennstdueinen.de/1148
-
Remote address:195.201.45.53:443RequestGET /1148 HTTP/1.1
Host: solr.kennstdueinen.de
Connection: Keep-Alive
ResponseHTTP/1.1 403 Forbidden
Date: Tue, 10 Dec 2024 01:29:25 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
-
149.154.167.99:443https://t.me/asifrazatgtls, http2024-12-10_1a9b310034f8c3838ae27e437a20e734_mafia.exe1.5kB 16.7kB 23 19
HTTP Request
GET https://t.me/asifrazatgHTTP Response
200 -
104.82.234.109:443https://steamcommunity.com/profiles/76561199439929669tls, http2024-12-10_1a9b310034f8c3838ae27e437a20e734_mafia.exe2.4kB 43.4kB 41 39
HTTP Request
GET https://steamcommunity.com/profiles/76561199439929669HTTP Response
200 -
195.201.45.53:80http://195.201.45.53/1148http2024-12-10_1a9b310034f8c3838ae27e437a20e734_mafia.exe503 B 536 B 10 4
HTTP Request
GET http://195.201.45.53/1148HTTP Response
301 -
195.201.45.53:443https://solr.kennstdueinen.de/1148tls, http2024-12-10_1a9b310034f8c3838ae27e437a20e734_mafia.exe1.0kB 4.2kB 14 9
HTTP Request
GET https://solr.kennstdueinen.de/1148HTTP Response
403 -
260 B 5
-
149.154.167.99:443https://t.me/asifrazatgtls, http2024-12-10_1a9b310034f8c3838ae27e437a20e734_mafia.exe1.6kB 16.5kB 21 18
HTTP Request
GET https://t.me/asifrazatgHTTP Response
200 -
104.82.234.109:443https://steamcommunity.com/profiles/76561199439929669tls, http2024-12-10_1a9b310034f8c3838ae27e437a20e734_mafia.exe2.3kB 43.1kB 38 37
HTTP Request
GET https://steamcommunity.com/profiles/76561199439929669HTTP Response
200 -
195.201.45.53:80http://195.201.45.53/1148http2024-12-10_1a9b310034f8c3838ae27e437a20e734_mafia.exe227 B 496 B 4 3
HTTP Request
GET http://195.201.45.53/1148HTTP Response
301 -
195.201.45.53:443https://solr.kennstdueinen.de/1148tls, http2024-12-10_1a9b310034f8c3838ae27e437a20e734_mafia.exe861 B 644 B 7 5
HTTP Request
GET https://solr.kennstdueinen.de/1148HTTP Response
403 -
156 B 3
-
50 B 66 B 1 1
DNS Request
t.me
DNS Response
149.154.167.99
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
64 B 80 B 1 1
DNS Request
steamcommunity.com
DNS Response
104.82.234.109
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
73 B 166 B 1 1
DNS Request
99.167.154.149.in-addr.arpa
-
72 B 147 B 1 1
DNS Request
134.130.81.91.in-addr.arpa
-
73 B 113 B 1 1
DNS Request
41.249.124.192.in-addr.arpa
-
67 B 83 B 1 1
DNS Request
solr.kennstdueinen.de
DNS Response
195.201.45.53
-
73 B 139 B 1 1
DNS Request
109.234.82.104.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
75.159.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 107 B 1 1
DNS Request
53.45.201.195.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
56.163.245.4.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 147 B 1 1
DNS Request
180.129.81.91.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
11.227.111.52.in-addr.arpa