Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05/01/2024, 05:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-01_e8530d1045162038a997139cd598f0d6_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-01_e8530d1045162038a997139cd598f0d6_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-01_e8530d1045162038a997139cd598f0d6_mafia.exe
-
Size
468KB
-
MD5
e8530d1045162038a997139cd598f0d6
-
SHA1
096632288285f5982a05d21b17c1fe1f83467652
-
SHA256
6d867dbb2bfc7a40abafc01efc581de1a7519cf82942ef5272be697edfab7a06
-
SHA512
988171d258536e4567360bb7084c2bfc468a76828b0151eaf55b6e7da937edb4c96e1872b9d1b92c5c1be58cfeed257c9c4674502c18b46042e62961b0dbb551
-
SSDEEP
12288:qO4rfItL8HG16zX2mX9vyZ4Nr0cmq7bWmeEVGL:qO4rQtGGM/XS4plmqumeEVGL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2572 8DC9.tmp -
Executes dropped EXE 1 IoCs
pid Process 2572 8DC9.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1580 wrote to memory of 2572 1580 2024-01-01_e8530d1045162038a997139cd598f0d6_mafia.exe 89 PID 1580 wrote to memory of 2572 1580 2024-01-01_e8530d1045162038a997139cd598f0d6_mafia.exe 89 PID 1580 wrote to memory of 2572 1580 2024-01-01_e8530d1045162038a997139cd598f0d6_mafia.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-01_e8530d1045162038a997139cd598f0d6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-01_e8530d1045162038a997139cd598f0d6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-01_e8530d1045162038a997139cd598f0d6_mafia.exe D060C608C177DE7E5488FF3022CABA170274003A86E67F568FE3632C1FF5A381C70406C9C412CFADA6E1E286AE34B0652F5591D55F631639E918C95E4055335A2⤵
- Deletes itself
- Executes dropped EXE
PID:2572
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD5ad83c20b4128a8c396243478847f569c
SHA186cd4df2eb672314d5b3cc0bc33d45bd0af62723
SHA25623ace96f6afd2827d822eba1a714d769d621b26a96d124f0f0331571593df6e3
SHA512b6097212af8fa804c2ab337b523a9cfc027cc1870090567a4a95c2d841a145eac1cdb367c20cda0a70d4ca482c17a5d83e531693b0ff5934f9e70f0e5ec05b55
-
Filesize
342KB
MD597e98073525151b08f31c0ee106c3d68
SHA1252a64ad01560f61925ec393d0613ffb09d1b563
SHA256a6d0acd37ce54204420a301c394c08a9af662f44efc764393ae13e72375354cd
SHA5126cd9e9165372780136ffc8c08a945af8fa740b796bd2252965ffb7f799cd6898369336fab757489e0090d3cae86e26156baab4e6834f3ec1961d4637a0521289