Analysis

  • max time kernel
    490s
  • max time network
    493s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-06-2023 04:57

General

  • Target

    a6f508861853d784835ff1d571adc4f073f0ab249ec5db63044ba801ac4137dd.exe

  • Size

    24KB

  • MD5

    5a996272261bb146770365ed5f7ce66a

  • SHA1

    10d4d188d6cfd75820dd4609729af1a20f524f47

  • SHA256

    a6f508861853d784835ff1d571adc4f073f0ab249ec5db63044ba801ac4137dd

  • SHA512

    71d0a876ba4003d89691a3df3d1dcc2a192fd842644c5ce00f853e22d22dc0c8f0fb768e7756dbc2eff50408d02ac9bb9347bc470a3c86fe61e43cf2074c5e20

  • SSDEEP

    384:b87CNBFHfMUQ9d4dGGM5HIe0tp7LQORs5L0escdVLrLKHxUcoLuokwlwAnlAFITr:b3zQ9iwLNOHxeLpv0xdoLqqc50M3O

Malware Config

Signatures

  • Detect MafiaWare666 ransomware 1 IoCs
  • MafiaWare666 Ransomware

    MafiaWare666 is ransomware written in C# with multiple variants.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6f508861853d784835ff1d571adc4f073f0ab249ec5db63044ba801ac4137dd.exe
    "C:\Users\Admin\AppData\Local\Temp\a6f508861853d784835ff1d571adc4f073f0ab249ec5db63044ba801ac4137dd.exe"
    1⤵
      PID:4480

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4480-133-0x0000000000930000-0x000000000093C000-memory.dmp

      Filesize

      48KB

    • memory/4480-134-0x0000000005840000-0x0000000005DE4000-memory.dmp

      Filesize

      5.6MB

    • memory/4480-135-0x0000000005330000-0x00000000053C2000-memory.dmp

      Filesize

      584KB

    • memory/4480-136-0x0000000005310000-0x000000000531A000-memory.dmp

      Filesize

      40KB

    • memory/4480-137-0x0000000005490000-0x00000000054A0000-memory.dmp

      Filesize

      64KB

    • memory/4480-138-0x0000000005490000-0x00000000054A0000-memory.dmp

      Filesize

      64KB

    • memory/4480-139-0x0000000005490000-0x00000000054A0000-memory.dmp

      Filesize

      64KB

    • memory/4480-140-0x0000000005490000-0x00000000054A0000-memory.dmp

      Filesize

      64KB