Overview

overview

7

Static

static

3

2023-08-27...JC.exe

windows7-x64

7

2023-08-27...JC.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2023, 14:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-08-27_0041d29a16978674290b6f76f90e9d71_mafia_JC.exe

  • Size

    444KB

  • MD5

    0041d29a16978674290b6f76f90e9d71

  • SHA1

    72e326d5973fb053c3e38e29589bee5ec0d8a889

  • SHA256

    ba0a32b6d7ae4037de091ccfdda59e91a56fb68def0a074ad05fe3efd3642ce7

  • SHA512

    4d83361ae8e85dc338633d0a33e2371aa852977e30c71cb2c01b0a52f51b79de9c0810ece5652d3f186c492026d06e1ecdc826c8d2417651094f2730eb998968

  • SSDEEP

    12288:Nb4bZudi79L2x/aaQ9DlHE5N12repYb9N7uA:Nb4bcdkLE4X+7oeY9

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-27_0041d29a16978674290b6f76f90e9d71_mafia_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-27_0041d29a16978674290b6f76f90e9d71_mafia_JC.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Users\Admin\AppData\Local\Temp\30C1.tmp
      "C:\Users\Admin\AppData\Local\Temp\30C1.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2023-08-27_0041d29a16978674290b6f76f90e9d71_mafia_JC.exe F506C0D17C3F6CB1B3BAB99CB255E6CE08438C666DCEC380FDE38CD0AF7614D2791D47B2F29DBB7BDA3CDB6607614C108B345294673556FD5DB691F519AF54D8
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\30C1.tmp
    Filesize

    444KB

    MD5

    6dbdc33fd99e4faa2074450e74955013

    SHA1

    9323002e466e1da2ac80d3155714dffc93fd709a

    SHA256

    09c1eb3b64a1904c689bee181b2eb6364b0dd15e720b8ef5d713938b22e0fe2d

    SHA512

    cfe37e03efcd01581dd1a5d51d7834c011956fb609cbed979c530ce10a4d70ff02476e7285fac000a298bf55a8a0a969eadc23105f0624b3291b980fdc8809f0

    Download Submit

  • \Users\Admin\AppData\Local\Temp\30C1.tmp
    Filesize

    444KB

    MD5

    6dbdc33fd99e4faa2074450e74955013

    SHA1

    9323002e466e1da2ac80d3155714dffc93fd709a

    SHA256

    09c1eb3b64a1904c689bee181b2eb6364b0dd15e720b8ef5d713938b22e0fe2d

    SHA512

    cfe37e03efcd01581dd1a5d51d7834c011956fb609cbed979c530ce10a4d70ff02476e7285fac000a298bf55a8a0a969eadc23105f0624b3291b980fdc8809f0

    Download Submit