Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
01/08/2023, 17:55
General
-
Target
35f11a166b6c6aed9e97f4be1428e0e3_mafia_JC.exe
-
Size
414KB
-
MD5
35f11a166b6c6aed9e97f4be1428e0e3
-
SHA1
583136a601a32e49dc9e4b71d9c4ffc97352043a
-
SHA256
fbe0c25157090209600316c475d5414172e3440ffa7b9002d7a605c2f7a6e33b
-
SHA512
48d467e365e3b36b78f99f72a70fc5964a089f284222005a4147af10380ec87f9f997c0cec414f056377abf96c99d2152ae7cacffce582fa17e1e2e1c20fb1cf
-
SSDEEP
12288:Wq4w/ekieZgU6xoV2uJNCClYVt6YwPsM2nrV1lx:Wq4w/ekieH6xo8TCQgYHM2Hr
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\35f11a166b6c6aed9e97f4be1428e0e3_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\35f11a166b6c6aed9e97f4be1428e0e3_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"C:\Users\Admin\AppData\Local\Temp\ACC3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\35f11a166b6c6aed9e97f4be1428e0e3_mafia_JC.exe E2F2FD7845CEF434DF2CFA36027000147D20CBBECED1E327F59E8E6F2BAB2B742AF8406EF4E1D877C9FF42BD5416114D11FC59F6470E652555D819DB490A20CB2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
414KB
MD5a5e9d42d3470391d94161c7850d56b7e
SHA1161ecdf41313ba0f09d9ac4501f29e58a55fa3c4
SHA256b22c0f5f8a651658a82b5a342d2afd2b2fb0a0cf835f0384005479edac5eb444
SHA512d8b2aa68bd081e12a1f216c55f6b6d1db547f89669bcd99e681a4a8a916babe556438c9931966499d703ae1b9a2b4f92b2bee82e87f68b60695e30b33d6ba4b5
-
Filesize
414KB
MD5a5e9d42d3470391d94161c7850d56b7e
SHA1161ecdf41313ba0f09d9ac4501f29e58a55fa3c4
SHA256b22c0f5f8a651658a82b5a342d2afd2b2fb0a0cf835f0384005479edac5eb444
SHA512d8b2aa68bd081e12a1f216c55f6b6d1db547f89669bcd99e681a4a8a916babe556438c9931966499d703ae1b9a2b4f92b2bee82e87f68b60695e30b33d6ba4b5