Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
11/10/2023, 17:43
General
-
Target
2023-08-26_606f81e930b7080e1f88ec8f030eee7f_mafia_JC.exe
-
Size
428KB
-
MD5
606f81e930b7080e1f88ec8f030eee7f
-
SHA1
e368c9d88f9ec8a5903733f9e77fd5c28d3e1bff
-
SHA256
2cc6f7e91ae4d66d644c2ff3d2823b35ed9554a4d45903727257ff9d5052e6c8
-
SHA512
6d7274e70e1458a6fe6d6a66d1634b42ec5d73211ae02e6a43b3e3b6272c83d2dce9518d348bd15bbb099fe27c779e05a99b4d38d28bd15445f0598b49e91081
-
SSDEEP
12288:Z594+AcL4tBekiuKzErtF7jjcZ0CYFAeoH6KrdfLrj9QmAlNl:BL4tBekiuVrfHjc6viDH6Kx9RAlN
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_606f81e930b7080e1f88ec8f030eee7f_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_606f81e930b7080e1f88ec8f030eee7f_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5C72.tmp"C:\Users\Admin\AppData\Local\Temp\5C72.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2023-08-26_606f81e930b7080e1f88ec8f030eee7f_mafia_JC.exe 01CCACA73CD52963A921B2100FCA1A5E3C203EBB8FD58B71BFBA0439A4F4C76707D42F52BE20BF122A954DA67B219ADC4F5D6B7B4D4A58DD29149B2CA85B607D2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
428KB
MD598b0ac0ff4f53841c084fd54f366de7c
SHA1d89b2976514d669cfd0091514720aef2f96047a1
SHA25625de623e87de20996a3d6bb0a73972422fc90f78c530172531a00467f2abb5a7
SHA5126f85d11c3c9bff82178fea3c0473a873a34825a187d25175cecc93b13b77aacd9ec5d7ffb918b068a6c9a64cc095d26fbead3f5975f839982ca8e87352f5c5ab
-
Filesize
428KB
MD598b0ac0ff4f53841c084fd54f366de7c
SHA1d89b2976514d669cfd0091514720aef2f96047a1
SHA25625de623e87de20996a3d6bb0a73972422fc90f78c530172531a00467f2abb5a7
SHA5126f85d11c3c9bff82178fea3c0473a873a34825a187d25175cecc93b13b77aacd9ec5d7ffb918b068a6c9a64cc095d26fbead3f5975f839982ca8e87352f5c5ab