Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
18/08/2023, 14:13
General
-
Target
2a27f93b7b7a9e298e31a2c4ac174563_mafia_JC.exe
-
Size
444KB
-
MD5
2a27f93b7b7a9e298e31a2c4ac174563
-
SHA1
c194ab08919cbfe3c3bf1fa9f1983a36c738efe7
-
SHA256
4c0ac5212e3e4b9c1bc2aacc137744fb4a6f8eb3a85d6683687e8448b0501916
-
SHA512
5f20038d534024ae7c1e85691367bcb8c93f88f60270ea9a50d7f0b5aea9498c166edc3dddd04133b244996e4179e478f20478d73cec219b89640928eaecc558
-
SSDEEP
12288:Nb4bZudi79LfJtgg58NtCTQ1DwDUz5maXdXkeAA:Nb4bcdkLxJitCTQKDwCe
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a27f93b7b7a9e298e31a2c4ac174563_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2a27f93b7b7a9e298e31a2c4ac174563_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8594.tmp"C:\Users\Admin\AppData\Local\Temp\8594.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2a27f93b7b7a9e298e31a2c4ac174563_mafia_JC.exe 4206098F105E0A1599870C9CF6E61A7F178255D577909E0E0A3869DB585141BCCBBF2AD04C621AD08E883BF35D6E045C01ECCBCE58EA6C6F0AD8521A2147B0C02⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444KB
MD5030b9d49fa39e7ef0e2689ed8f82902d
SHA1433526ee140c65177ec24a62f759272f4a0fcc82
SHA256f10804254fdfdfe332fe11e340f1c1cd6dcce33e5d4d3bc05cf941c94d6da191
SHA512fdb1b51047efaad325f4c286fb2fa1217e1da4ab74de99423019809526b218e3bf728c64b22c18166f3ea5c5a564496610a059589073fc16cbb9a7fa9cf7db02
-
Filesize
444KB
MD5030b9d49fa39e7ef0e2689ed8f82902d
SHA1433526ee140c65177ec24a62f759272f4a0fcc82
SHA256f10804254fdfdfe332fe11e340f1c1cd6dcce33e5d4d3bc05cf941c94d6da191
SHA512fdb1b51047efaad325f4c286fb2fa1217e1da4ab74de99423019809526b218e3bf728c64b22c18166f3ea5c5a564496610a059589073fc16cbb9a7fa9cf7db02