Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
09-01-2024 06:42
General
-
Target
2024-01-08_6ee7c61d1d975410846f7a974e1eff38_mafia.exe
-
Size
443KB
-
MD5
6ee7c61d1d975410846f7a974e1eff38
-
SHA1
78b133af37b50f0eb2189ae7d7fed9407b6efc22
-
SHA256
8e4403443155e2bfb6e0a8f7bd365d2c27b62713ed95045db902c80ae7adde31
-
SHA512
003000040d481ba68bd05a873e13845edf0a843cf0b044b3ff05dea5cc2b9a6be1c6c08a3641f59d87d03e292af72b0768a884747aa538541a24cdae331291ad
-
SSDEEP
6144:Wucyz4obQmKkWb6ekie+ogU6BYewi00I7MUxNOxdeafQfMJS2OENL4OmUIAllMa:Wq4w/ekieZgU6TwiRxdDQkcVE94PSlMa
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-08_6ee7c61d1d975410846f7a974e1eff38_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-08_6ee7c61d1d975410846f7a974e1eff38_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-08_6ee7c61d1d975410846f7a974e1eff38_mafia.exe 6EC134D9D6518D78E94F88A58E1C48974E39CB005427AB513AB66BF10EAB83FDBD97F48501E869C7FF2A312493A37D4FCEE17F8987E612D8E5161F086E6C7FFA2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5c17aab0a96f6b0d6436d6a09e5818e2b
SHA10a781d33fd0140295567e68185c4b90a1db62c46
SHA2566dcdb85eb8075f95f71307036af3e948f8bbecf0a6681e599f368185da3a5eda
SHA512486d597c166e969684bea733efe43afe8d0bc6c5ed3ccae8bea775c21e4aa97a675013b435087d8d0e55668dfbfe20dee6eba64c0a9ff233b4b21a69685fe202
-
Filesize
111KB
MD551cd8332234f6cfdadf838ac3ada0941
SHA1fcb31f13983f3d213df6abf2986c74dc82874b1b
SHA256d9438e0d003e931a2d504e97fac62b4e2636c596a715da6d4b1584ac8dc74d55
SHA5129b1152eb824143024d2bf5e7b47d693f755e7afa404396d143fd902b157f195aa765bf34600503eca151508ae0e7e7f89921d56a541c2dfb5961df5543e06c9e