Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
15-08-2023 16:57
General
-
Target
fa520b4274cd46d9d64ec58a3b194d05_mafia_JC.exe
-
Size
428KB
-
MD5
fa520b4274cd46d9d64ec58a3b194d05
-
SHA1
94d5e432e639a38d86ab99a3d67cc5817d093343
-
SHA256
634db5fe8466359b8e61869a338d4d28734397ae5a450d3c9d4c8f0812a352b8
-
SHA512
1b3f0e1bbf9d8c17d1b0a84cde0c6e89653f5e49a1f0950e9a36b44c802fd865807b36d3c8dde7c4c87435ba79be25fb614402a16fd00d2152e0b15541df7013
-
SSDEEP
12288:Z594+AcL4tBekiuKzErZ4YR7Cs0N/3dbDFYlHvTCMQl:BL4tBekiuVrqYIs0NPdVEvI
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa520b4274cd46d9d64ec58a3b194d05_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\fa520b4274cd46d9d64ec58a3b194d05_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp" --helpC:\Users\Admin\AppData\Local\Temp\fa520b4274cd46d9d64ec58a3b194d05_mafia_JC.exe 844043FE10894DA68655F81CA625699E576B93AB819D2F16D2E77FEACDC04B7821C299CC889650C0E944491F218A84C447B8503FB2B8B8AEE913AB77262188622⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
428KB
MD5a9feb261508c1aba276347e2f7c46ae3
SHA1145b1070853317bc3bdb50d0177295114f2969fa
SHA2567a58a99aa6a74f7d9c1c5ac7c5c1873a70fb3859656619dec8c9886ccbdfa6b4
SHA5127bc79bb1b963e97a9a7390e4cab6c641ad7772a37b17e51e05d351665c191d16ad42846835db99d0061ac112a69070064b45cc0ec59d1461cf9aa5628fafa60d
-
Filesize
428KB
MD5a9feb261508c1aba276347e2f7c46ae3
SHA1145b1070853317bc3bdb50d0177295114f2969fa
SHA2567a58a99aa6a74f7d9c1c5ac7c5c1873a70fb3859656619dec8c9886ccbdfa6b4
SHA5127bc79bb1b963e97a9a7390e4cab6c641ad7772a37b17e51e05d351665c191d16ad42846835db99d0061ac112a69070064b45cc0ec59d1461cf9aa5628fafa60d