888d0458be5c59e4fb353038cacae0efc612d364a3c970b420c06d9df7b5471a

Analysis

max time kernel
127s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 05:59

Target

2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe
Size

412KB
MD5

a596f9e6979d52cef92705811189a5e0
SHA1

a4e280e38e4f70c7fe107c71c967d560e1451a90
SHA256

888d0458be5c59e4fb353038cacae0efc612d364a3c970b420c06d9df7b5471a
SHA512

22ff9d7d553caef101d97b3855b7625ba80a893374832dc07cf31b61e5a0cd2dc0f0d332d025004e1fd61ea6352c6039c7e5abc39ac4f91c35724b1b35857356
SSDEEP

6144:UooTAQjKG3wDGAeIc9kphIoDZnrghNqZD9yPMny4UmeFWhbCFP:U6PCrIc9kph55ghNqBEMnWmvYt

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2600	D486.tmp

Executes dropped EXE 1 IoCs

pid	Process
2600	D486.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 2600	4616	2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe	88
PID 4616 wrote to memory of 2600	4616	2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe	88
PID 4616 wrote to memory of 2600	4616	2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\D486.tmp
  "C:\Users\Admin\AppData\Local\Temp\D486.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe 83521CFDEC5506736815A53E9F8F259FE0BFB28F5FBDD56BCE4C6FB913A1C927E6CA9F3C8124880A1456513E8285D3565C7DFF02E8F8B9879113C09D449EE68E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2600

C:\Users\Admin\AppData\Local\Temp\D486.tmp

Filesize
79KB

MD5
8d5dd73a1f2e4955fef96492cc33ccb5

SHA1
edc642a70854f88647c5da6cf39cc6a704daeeaa

SHA256
dcf7b932ad9adec8d67340acc627ffb2ea82cfed258eb589e3e39c341550e64b

SHA512
d7b112df787e2a0d479ab645a28982c3c248de79cb8bcbc98b3e61fd72633cbdc9e201c5f2058cbaf9ba8e58aabe914e086521cb94e2677b1883eef0d36bfdde

Download Submit
C:\Users\Admin\AppData\Local\Temp\D486.tmp

Filesize
86KB

MD5
da813545b0c135355993a21a62cffe50

SHA1
0bdb7713372e9616daf9cfa414c7589ba725f0ab

SHA256
973c5a7ab6ccf7c8cfa5c2081e24ab5d28a11f0e6053d2506d74ae2f953efae5

SHA512
2df67ad8768b24f52c8919f8235275128f89f3623ef9a6e0bc157cfa061b3664eae873cedf590ab5dc0fce641bd8b6ac5a5e03e1b7bf2a7e7da0413020a54976

Download Submit