Overview

overview

7

Static

static

3

2024-01-09...ia.exe

windows7-x64

7

2024-01-09...ia.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    10/01/2024, 06:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-01-09_fda615a2ca1ea303eb4ecf8fbc287cf4_mafia.exe

  • Size

    479KB

  • MD5

    fda615a2ca1ea303eb4ecf8fbc287cf4

  • SHA1

    fa274ae7075580dd7ef3341ef9ea903b72ce7881

  • SHA256

    50fbc058ca88e9bac20efe56b557691e1002c24d5a6c09e8b700c0fe755dc102

  • SHA512

    4f7bd85814cd0fbf12f1d0ede10dd10fa1d64481dcec1b43e2c7de7720a61011da783aa5e85394898802c7e8457864ee8c4a0bbc9c68bc2cffcbc5c5d6bcdd14

  • SSDEEP

    12288:bO4rfItL8HA5mDNLRSel+jF5N0+MM49jW775UO:bO4rQtGAURSely00KjSVUO

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FAA.tmp
    "C:\Users\Admin\AppData\Local\Temp\FAA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-09_fda615a2ca1ea303eb4ecf8fbc287cf4_mafia.exe 61935F3EF6B82187D65DCCB7EDFC8640D65CF58152C7EFF43D34E8B334B08E854EF7E244D2B1FECA22CCD6D5C940E2962800C9FD5AB5BEC5040417F89290F303
    1⤵
    • Deletes itself
    • Executes dropped EXE
    PID:1904
  • C:\Users\Admin\AppData\Local\Temp\2024-01-09_fda615a2ca1ea303eb4ecf8fbc287cf4_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-09_fda615a2ca1ea303eb4ecf8fbc287cf4_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\FAA.tmp
    Filesize

    1KB

    MD5

    37481d8787196399c616fcdd42137df5

    SHA1

    082d87ca70d14ae62c1a5c388cdc90fa147c86e8

    SHA256

    008c3bf829f8735a837ce647e8467c67236f2b82d795dea15d55f5a6eabd6f3d

    SHA512

    69cc9f800b2103ede8dc9fe9e4a1bffc6dc30a51b52b85054de8d760e2ab657fb9f2c3b4c5d9f444e33de0bc94b936b0e0a51b66e97fe7aaee995e51fa4e0b05

    Download Submit

  • \Users\Admin\AppData\Local\Temp\FAA.tmp
    Filesize

    5KB

    MD5

    d43ed4e2b280ac78d6807e33b47fe591

    SHA1

    205d17006fa827afad8e8dc56b5ef3c2c3033186

    SHA256

    294160d95040549d2be83331680f380c449d8a44d27d3eccaee6c3e0a970a78f

    SHA512

    8aa0341c7fad7b2cba1381a79afce1a8c76f035f74dd8910f41fbecb9697b7e03e5f8379469ff4e3c7b3ba19bc8b6f40c3cc768ef5805f39194b2b8914d993b2

    Download Submit