Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
08-08-2023 16:54
Static task
static1
Behavioral task
behavioral1
Sample
9b0d21db027e924a545a9f79b3b73df2_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9b0d21db027e924a545a9f79b3b73df2_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
9b0d21db027e924a545a9f79b3b73df2_mafia_JC.exe
-
Size
411KB
-
MD5
9b0d21db027e924a545a9f79b3b73df2
-
SHA1
739e9c922249ab82ddd0e2e34304672f0bf40790
-
SHA256
fd82f1d94bcc884e61cbb2f10f4f04a6d7f702a6ac97016342630cc3699737ea
-
SHA512
6210862b0abaa8b91b52f467cdee758e0a7f282cc91521892eb29e6cfcb8267728788ac6bc5914974276b690dfa6ed2a51c3faaceae61ac92ba888134274d2ed
-
SSDEEP
6144:gVdvczEb7GUOpYWhNVynE/mFGEC/uiPv2XS6kYc36mF0NY60nFjqHI:gZLolhNVyEnr/uiH2Xvzbm6NY6+5qHI
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2064 7A9C.tmp -
Executes dropped EXE 1 IoCs
pid Process 2064 7A9C.tmp -
Loads dropped DLL 1 IoCs
pid Process 2468 9b0d21db027e924a545a9f79b3b73df2_mafia_JC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2064 2468 9b0d21db027e924a545a9f79b3b73df2_mafia_JC.exe 28 PID 2468 wrote to memory of 2064 2468 9b0d21db027e924a545a9f79b3b73df2_mafia_JC.exe 28 PID 2468 wrote to memory of 2064 2468 9b0d21db027e924a545a9f79b3b73df2_mafia_JC.exe 28 PID 2468 wrote to memory of 2064 2468 9b0d21db027e924a545a9f79b3b73df2_mafia_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b0d21db027e924a545a9f79b3b73df2_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\9b0d21db027e924a545a9f79b3b73df2_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"C:\Users\Admin\AppData\Local\Temp\7A9C.tmp" --pingC:\Users\Admin\AppData\Local\Temp\9b0d21db027e924a545a9f79b3b73df2_mafia_JC.exe 4521DC4F58396949FAB8C942C629A968D90095041FC88DCBA05D7A9C6EF27BDC66F2151F9A6FF709B32AEB238EC8C13814115C52F5F9E03D6379A3C3D30E07082⤵
- Deletes itself
- Executes dropped EXE
PID:2064
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
411KB
MD5aa4fd1e44fde6e5df62300e48f1d7658
SHA15378c2c3a6b30eccd705df99ce47cfe78b93e8ee
SHA256cd42f9c1c35cfbbb81358cb46bd9f14231e24ef2d7a9f8e8575138dfbc768a98
SHA51279ac3dbfadf3a611a0a9b972452014a87dd6e5746fb9b46017e51be926817ab4a615ee3a5eec10ce2f18c4c1a6e054b247be209050a95e274ecadcfae158f42f
-
Filesize
411KB
MD5aa4fd1e44fde6e5df62300e48f1d7658
SHA15378c2c3a6b30eccd705df99ce47cfe78b93e8ee
SHA256cd42f9c1c35cfbbb81358cb46bd9f14231e24ef2d7a9f8e8575138dfbc768a98
SHA51279ac3dbfadf3a611a0a9b972452014a87dd6e5746fb9b46017e51be926817ab4a615ee3a5eec10ce2f18c4c1a6e054b247be209050a95e274ecadcfae158f42f