3314851b0925f24ccf7b4bc12d1ef3fa7c308b9a5136727118f1b58474bd134c

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe
Size

906KB
MD5

36e910c6e230456c98672821d88d3f9f
SHA1

6f4ed920ed618ce9df5e84823c7547ff0bb30e9f
SHA256

3314851b0925f24ccf7b4bc12d1ef3fa7c308b9a5136727118f1b58474bd134c
SHA512

824507b1f98103101372bc12ce37d66d7ed8918e76b286905bbcd673a17b3d2fb21a9ad250661406996bbc5acae4d9ff5b3f17e0f4f5076c1d779787658ab7f1
SSDEEP

12288:QUHzKufgk0IpzpXxsPsM+80/9OCOaVLR7g1xGkgBaFSkYu8DU0OYhLu0O49gY4B:THVfSIpzpBsGACO0LRs1kk6i6uKVOu4B

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation 2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe
Executes dropped EXE 3 IoCs

Processes:

minidownload.exeDownLoadDlg.exeExceptionReport.exe

pid process

3484 minidownload.exe
4936 DownLoadDlg.exe
2988 ExceptionReport.exe
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exeDownLoadDlg.exe

description ioc process

File opened for modification \??\PhysicalDrive0 2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe
File opened for modification \??\PhysicalDrive0 DownLoadDlg.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe

pid	process
3484	minidownload.exe
4936	DownLoadDlg.exe
2988	ExceptionReport.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe
File opened for modification	\??\PhysicalDrive0	DownLoadDlg.exe

Drops file in Program Files directory 32 IoCs

Processes:

minidownload.exe

description	ioc	process
File created	C:\Program Files (x86)\SogouDownLoad\html\config.ini	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\download.html	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\bg_line.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\btn_spr.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\btns.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_set.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_spr.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\rocket1.swf	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\js\swfobject.js	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\dlico.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_t.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\img_exe.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\progressbar.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\css\down.css	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\attention.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\check.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\repair.html	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\dlbg.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\error.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\error2.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\errorbg1.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_min.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\warning.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\js\actions.js	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\settings.html	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\ico_close.gif	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\js\jquery-1.11.2.min.js	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\css\downloader.css	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\errorbg2.png	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\html\images\rocket2.swf	minidownload.exe
File created	C:\Program Files (x86)\SogouDownLoad\crash\ExceptionReport.exe	minidownload.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
NSIS installer 2 IoCs
installer

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\minidownload.exe nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\minidownload.exe nsis_installer_2
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

DownLoadDlg.exe

pid process

4936 DownLoadDlg.exe
4936 DownLoadDlg.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

DownLoadDlg.exe

pid process

4936 DownLoadDlg.exe
4936 DownLoadDlg.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\minidownload.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\minidownload.exe	nsis_installer_2

pid	process
4936	DownLoadDlg.exe
4936	DownLoadDlg.exe

pid	process
4936	DownLoadDlg.exe
4936	DownLoadDlg.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exeDownLoadDlg.exe

description	pid	process	target process
PID 3492 wrote to memory of 3484	3492	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	minidownload.exe
PID 3492 wrote to memory of 3484	3492	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	minidownload.exe
PID 3492 wrote to memory of 3484	3492	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	minidownload.exe
PID 3492 wrote to memory of 4936	3492	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	DownLoadDlg.exe
PID 3492 wrote to memory of 4936	3492	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	DownLoadDlg.exe
PID 3492 wrote to memory of 4936	3492	2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe	DownLoadDlg.exe
PID 4936 wrote to memory of 2988	4936	DownLoadDlg.exe	ExceptionReport.exe
PID 4936 wrote to memory of 2988	4936	DownLoadDlg.exe	ExceptionReport.exe
PID 4936 wrote to memory of 2988	4936	DownLoadDlg.exe	ExceptionReport.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-05_36e910c6e230456c98672821d88d3f9f_mafia.exe"
1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:3492

C:\Users\Admin\AppData\Local\Temp\minidownload.exe
C:\Users\Admin\AppData\Local\Temp\\minidownload.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3484

C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe
"C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe" /Install?status=true&softurl=http%3A%2F%2Fxiazai.sogou.com%2Fcomm%2Fredir%3Fsoftdown%3D1%26u%3DYRyEVuHeM45mBjjEUSPVUEJm8GF_McJfVdEjKPrgnocp6RPTnPFSKls2-N19zn1VVyIyQ0EaAFzVunBLAWIXs1gXJ8-dW6ZyJd2HMCZpOTvLIGNafI07QZpggfaFdLzRilLVZzhV53fF-ago-P3fECJIPRI-Fuc_AxfASetSfW-faQ80d0IKxv44fPBspu-9gJ23-t3zxt4Y4-C8cvpfCNZHher5qyyKJrSsN3LkAxu_IhNtWMXWFw..%26pcid%3D-9085129097648098765%26w%3D1950%26filename%3Ddjyx_134_1389168322_djyx_134_2014-1-8_VIPDL_signed.exe%26extra%3D5_tencent%26downloadtype%3Dsoftware%26stamp%3D20160414&iconurl=http%3A%2F%2Fimg02.sogoucdn.com%2Fv2%2Fthumb%2Fretype%2Fext%2Fjpg%2Fcls%2Fimagick%3Fappid%3D200504%26url%3Dhttp%3A%2F%2Fpc3.gtimg.com%2Fsoftmgr%2Flogo%2F48%2F11245_48_1390193625.png&softname=%E5%8D%A1%E7%89%87%E5%8F%AC%E5%94%A4%E5%B8%88&softsize=2.8+MB
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936

C:\Program Files (x86)\SogouDownLoad\crash\ExceptionReport.exe
"C:\Program Files (x86)\SogouDownLoad\crash\ExceptionReport.exe" "dump202407050750"
3⤵
- Executes dropped EXE
PID:2988

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\SogouDownLoad\DownLoadDlg.exe
Filesize
795KB

MD5
1a21e9b1435c06e562a1c6a2e92a82d6

SHA1
60457394473cb75fca7d3fe5069231e82c84a4e6

SHA256
35e9bfc9e668511572a1e41f9421b5bd931e1b66a0562789453690f306a9af8e

SHA512
d4336ddc4969c19078c0b06ae799a9062c571de12f471cdc6fcc8f9d27e3f8aebe75a0de47eaf7f719c3a58f69d40f7c28a964ab88cd9ef2b566c73e0e9f3eff

Download Submit
C:\Program Files (x86)\SogouDownLoad\crash\ExceptionReport.exe
Filesize
111KB

MD5
ba7121a86dbffafc97e1b8c11c17e199

SHA1
922e584be46621e0ab57d3bb47b7c5dee8230ea8

SHA256
0bc616a788f782a37b8fb0134ffabdd8a2988205a125b2f400c3deb43e2a8971

SHA512
22641abfa34f8ed5c24375b221b6cae935fadffb4b1cf9f8c452658538dd4af459ec7e6a95d05fb7b3aa0fcb4bd195fa18d6fe787ece282fa5c5a8187da76197

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\config.ini
Filesize
116B

MD5
ffa1443199298e2c4ff1122f1ae14b05

SHA1
96175a64c1f8ba142aa057e8f76e13467ecefb82

SHA256
2d21ddb94831d5345bbfbe52ecd342067cf49c6eaf8c78057e1901b6c69c6574

SHA512
3955846ed694c43d2d9857168e1c3fee9714ecea70c0af04b1db6d7be5b4805b92730d74bc4a74ed5464c47e4af558b8d040d0efc8ec276fcb8c50c346fe61de

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\css\downloader.css
Filesize
7KB

MD5
0079cdb145c388c3e4c5e2235ac97bce

SHA1
7a8fee29992183dd572c52a1f6ca24219f4d8cba

SHA256
f4890eb5df2bb1b2921c0e561388780b4e2871998ca5aa7f4ec8bbf6ea1a715c

SHA512
7387d097152a49f8c57db203d89f64f6d2f905b60f69fa90d26ee3ebcab6428865e745fca63600c724c296db85d299502b4133cacd4b7dbcd4653712a82caa46

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\download.html
Filesize
7KB

MD5
382c18d88309c186f501dc3d31876461

SHA1
1c602b521deec4e2826e9280fed7e586351282c4

SHA256
67293d69f293e3347dd6eaabf19b84d3bba0fbc00fcc19d79be354da3f105687

SHA512
f82ba3616734551eef1239203cc09531280f1c9118edc1f1218c18247c13dc3455e7d783f440a919a1df47922d33ed8526deabd979fe4d12e6cef2a5707c045d

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\images\img_exe.gif
Filesize
657B

MD5
0e0ac8352cd69f396f271fa32f3ab554

SHA1
ed6d306a5033707f45477df3318a53d15b47cf43

SHA256
c2c34d6bf4e17b756954e409dc9b5663169d68997abd722ce1e86473b769f10c

SHA512
5d2528489c21600f16f04559500be3ebe9db5a1dc7bf9abc9c1312187b4b8b7bc5966f9eb2a38e26bff26c854a6d964fa156641fed9501cf0e7befedb60fd7e0

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\js\actions.js
Filesize
8KB

MD5
3b4a5f925a08bd18b636880b8d557077

SHA1
73ed8c3697681e7999bae4fdcc62867b263182ce

SHA256
48b8718ba8de855d6c937b23eb7ccc4f5482e6619de9261324c12a48ae6769dc

SHA512
aa5ffd3040a6eb964ed7c70d138e3201989f78551610e22585077fa86bff58740500d6309c339a2dded56481d04f7416ca97b22548fde4661f7da39c9600644b

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\js\jquery-1.11.2.min.js
Filesize
93KB

MD5
5790ead7ad3ba27397aedfa3d263b867

SHA1
8130544c215fe5d1ec081d83461bf4a711e74882

SHA256
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0

SHA512
781acedc99de4ce8d53d9b43a158c645eab1b23dfdfd6b57b3c442b11acc4a344e0d5b0067d4b78bb173abbded75fb91c410f2b5a58f71d438aa6266d048d98a

Download Submit
C:\Program Files (x86)\SogouDownLoad\html\js\swfobject.js
Filesize
10KB

MD5
631f38cfac458788af482eba736e5ac3

SHA1
b1d09def39ec74eff2c9e0aafe0a7c12e7650150

SHA256
13e6cf03cdd65a8174cce7b0cb40c9821d2aff04a79c3374e8664fb0abb5694d

SHA512
3ae47c895cd586b1dca8bdf65c58bc896b27837881cc42bb7b3d55c9a71ea9e857939a69c5146b445b64714996393d1ec9c0d95b18d18fd5cb48f02bb8a53f42

Download Submit
C:\Users\Admin\AppData\Local\Temp\CRASH.DMP
Filesize
94KB

MD5
4a8ecce48ee6e9a13771dfa07c1b47dc

SHA1
25e9610868b05d77371e57d9a161cf0bd182b3a4

SHA256
31a9fcb99ce09b1f257b5909a62326c16980f4ade022b5c803115040cdd6c7be

SHA512
2a33b88bfc53f75f4083e30a76bed4c6541f333fcd491cf545d94734186cb4b515f9695d9e6fa8bdbdafafaf7a0f9fded067abcf1bf1f117771689d0ad17b544

Download Submit
C:\Users\Admin\AppData\Local\Temp\ERRORLOG.TXT
Filesize
31KB

MD5
15b93b823dea1da369309edb5b309b7e

SHA1
cb5ef2db7dabcf52a82bde24f45d1138f984cbb2

SHA256
143fb62466bb5058c1d12c09983ebd9785dd7cf7fe79dcd2a8d54f9b65a56b4d

SHA512
ab84b158adde0cdbfbfedd4a8c4370c9832b94eb703cbbc9e7685599f80d6d0dda93b8fa3ab767b35429f097cefb8ac29f2534cc4f4cb7cfa1ed103c2d2920fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\minidownload.exe
Filesize
499KB

MD5
92611a7ef872df59c53eab1e76855a9d

SHA1
41351edd9c7a5587a2ba7793131205a8bc3896e8

SHA256
b655815e0b129134ccebd00f44eb87f85e72eb37a1879509e90f539dda4600cc

SHA512
1b07e6ef576751ee20e4d2c43031aa4d668b8dd3f58dd403db56fb9cce39c4c8646cb2c0268596c3df67f7fbbddefc017e5205f8f27612fb269caffa52536f0b

Download Submit
memory/4936-45-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download