Analysis
-
max time kernel
125s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
21/03/2025, 08:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
Resource
win7-20240729-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe
-
Size
2.7MB
-
MD5
07b1087127e38101002b049e95e1ddcf
-
SHA1
394702087a93e47a25f3610c096cdc82747224ca
-
SHA256
6800e76ac53d68c3576f2293f4447e93496b337ef447cb57be447149a0c4ebfd
-
SHA512
8e9d1e973d73164108b0a458060f7ec0e1bf24bb0d9186fa5cbf54f927de15a25d5995f66cf0d4fcc0e08703ca5b5d48221a63f53027ed7b91174b614beb6f58
-
SSDEEP
49152:9HHKO29Qm5QZuTtS0rQMYOQ+q8CEKTG4QaTGHQ89KFeMK:9nKdtWsM0r1QnxK4DKH30FeT
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2656 ded1f850 -
Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 38 223.5.5.5 2096 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe Destination IP 125 223.5.5.5 2096 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe Destination IP 139 114.114.114.114 2096 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe Destination IP 216 114.114.114.114 2096 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe Destination IP 2 114.114.114.114 2656 ded1f850 Destination IP 37 114.114.114.114 2096 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe Destination IP 55 114.114.114.114 2096 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe Destination IP 115 114.114.114.114 2656 ded1f850 Destination IP 140 223.5.5.5 2096 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe Destination IP 217 223.5.5.5 2096 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 ded1f850 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 ded1f850 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 ded1f850 File created C:\Windows\Syswow64\ded1f850 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat ded1f850 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 ded1f850 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2d78c0 ded1f850 File opened for modification C:\Windows\23e260 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ded1f850 -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates ded1f850 Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53BF6718-92A5-4F1A-8083-46CA22CF3C00}\4a-3b-ff-8f-95-2c ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs ded1f850 Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-3b-ff-8f-95-2c\WpadDecisionReason = "1" ded1f850 Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-3b-ff-8f-95-2c\WpadDecision = "0" ded1f850 Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ded1f850 Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot ded1f850 Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0121000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ded1f850 Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53BF6718-92A5-4F1A-8083-46CA22CF3C00}\WpadDecisionReason = "1" ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust ded1f850 Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ded1f850 Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53BF6718-92A5-4F1A-8083-46CA22CF3C00}\WpadDecision = "0" ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-3b-ff-8f-95-2c ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs ded1f850 Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust ded1f850 Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-3b-ff-8f-95-2c\WpadDecisionTime = f0ac7033389adb01 ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople ded1f850 Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 ded1f850 Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53BF6718-92A5-4F1A-8083-46CA22CF3C00}\WpadDecisionTime = f0ac7033389adb01 ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs ded1f850 Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53BF6718-92A5-4F1A-8083-46CA22CF3C00}\WpadNetworkName = "Network 3" ded1f850 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ded1f850 Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs ded1f850 Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{53BF6718-92A5-4F1A-8083-46CA22CF3C00} ded1f850 -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2656 ded1f850 2656 ded1f850 2656 ded1f850 2656 ded1f850 2096 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe 2096 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe 2096 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2096 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe Token: SeTcbPrivilege 2096 2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe Token: SeDebugPrivilege 2656 ded1f850 Token: SeTcbPrivilege 2656 ded1f850
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-21_07b1087127e38101002b049e95e1ddcf_amadey_mafia.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
C:\Windows\Syswow64\ded1f850C:\Windows\Syswow64\ded1f8501⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize71KB
MD583142242e97b8953c386f988aa694e4a
SHA1833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD516dc5b2fed1c6e5cdeed305ef5d65376
SHA127ccb8787ecb66a43c2a5c8dbec7d9880cf601a2
SHA25605d7f5b337b108539656cb6f853e5a801d53558ff1ae2f146427735cd742baa3
SHA512ca86cbc462bd68653e652e8d9bfd5ea4ea131b5175512fac09b14133802bc24c3a9e119c4abaad82d64ba0f6fc3eca13e6b4b9444830df6946d23ad5d37ebc49
-
Filesize
2.7MB
MD53e50e7fc673c13c6218f7e8ae5258607
SHA1cfd4869057b366570e0fe887f12c3d7a13fdabb4
SHA2562d7993562ec7ee3d3aae7c0e3d48645214f55ea4be25f346beb0048f6d005667
SHA5121e3b254b03c33d1285de031f36295552fd667b32754dece76fbe5baf0d6532209da9cf5f9d164eab4245346c56f45ee06edd3421b4bec1af42192a5a4629b968
-
Filesize
183KB
MD5109cab5505f5e065b63d01361467a83b
SHA14ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc