Analysis

  • max time kernel
    144s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/01/2024, 06:04

General

  • Target

    2024-01-09_fda615a2ca1ea303eb4ecf8fbc287cf4_mafia.exe

  • Size

    479KB

  • MD5

    fda615a2ca1ea303eb4ecf8fbc287cf4

  • SHA1

    fa274ae7075580dd7ef3341ef9ea903b72ce7881

  • SHA256

    50fbc058ca88e9bac20efe56b557691e1002c24d5a6c09e8b700c0fe755dc102

  • SHA512

    4f7bd85814cd0fbf12f1d0ede10dd10fa1d64481dcec1b43e2c7de7720a61011da783aa5e85394898802c7e8457864ee8c4a0bbc9c68bc2cffcbc5c5d6bcdd14

  • SSDEEP

    12288:bO4rfItL8HA5mDNLRSel+jF5N0+MM49jW775UO:bO4rQtGAURSely00KjSVUO

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-09_fda615a2ca1ea303eb4ecf8fbc287cf4_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-09_fda615a2ca1ea303eb4ecf8fbc287cf4_mafia.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3856
    • C:\Users\Admin\AppData\Local\Temp\55D1.tmp
      "C:\Users\Admin\AppData\Local\Temp\55D1.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-09_fda615a2ca1ea303eb4ecf8fbc287cf4_mafia.exe 574068C1C18472EDEE3D75074F8E624E9662BC482870D0B611033A60DCB544A143B4864995C5C65EBD9FF87FC93B8B3B9A0473E6ED6C6983BD60C4B444663A42
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads