929cf6397e1c3d6e47130b3f53c22665aeeac8d01caf319df0692731649c45b0

Analysis

max time kernel
154s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 05:56

Target

2024-01-11_298c2f423474c9caba0a0b93cb8d93fd_mafia.exe
Size

412KB
MD5

298c2f423474c9caba0a0b93cb8d93fd
SHA1

a3857a33478750e2650f59ebce1a1fe8e90ce2d7
SHA256

929cf6397e1c3d6e47130b3f53c22665aeeac8d01caf319df0692731649c45b0
SHA512

e57e2c4ebfaa815d83afe182bf3befea606033c740007b1db4e9a32caf06588cf5bc214162283c385f55076a5510f5f0fdde6c681a2e7bf2bbf0178ec8fd986c
SSDEEP

6144:UooTAQjKG3wDGAeIc9kphIoDZnH+YGVqlyraAv1f7B2nUD83l4ZAZ+Q2Md+4lz0:U6PCrIc9kph5hl8Nf7gnUQ3CAd2D4FD

Score

7^/10

Deletes itself 1 IoCs

pid	Process
368	B5F2.tmp

Executes dropped EXE 1 IoCs

pid	Process
368	B5F2.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 368	3528	2024-01-11_298c2f423474c9caba0a0b93cb8d93fd_mafia.exe	66
PID 3528 wrote to memory of 368	3528	2024-01-11_298c2f423474c9caba0a0b93cb8d93fd_mafia.exe	66
PID 3528 wrote to memory of 368	3528	2024-01-11_298c2f423474c9caba0a0b93cb8d93fd_mafia.exe	66

C:\Users\Admin\AppData\Local\Temp\2024-01-11_298c2f423474c9caba0a0b93cb8d93fd_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_298c2f423474c9caba0a0b93cb8d93fd_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Users\Admin\AppData\Local\Temp\B5F2.tmp
  "C:\Users\Admin\AppData\Local\Temp\B5F2.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-11_298c2f423474c9caba0a0b93cb8d93fd_mafia.exe 175E737DC30439DEBCA26AA6D9393770EDB51A88558A9E8E1DFC0B8444604450BB2832E33C0E1EE854608DFA652D28C7AEC021F7197431E13B126BAC550960CA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:368

C:\Users\Admin\AppData\Local\Temp\B5F2.tmp

Filesize
87KB

MD5
5a977ad7e4fa23104e0380aae8399e14

SHA1
72ce764d88c01a344d78d515a6892b91599f74d8

SHA256
3debc4f0650b0dd7e2878287a8d9f7089d8eb696ecb6efcee996663c093ab61c

SHA512
85d61884439e33292730a7940f598245780eaf91dd04647e540c7b4f9a296a9285003656de7aae02e4bddd34927da02bce845d92b19477cdfd5af0bd447e40a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp

Filesize
64KB

MD5
2f28799e49bd862ed53f064ff90e3c6e

SHA1
ac03516dc49de17d87bd82998f19514a20814193

SHA256
bca3e70b5becbef9aa40ce1e1a8dfdee907a0be2e87fe823d1fe0a0a28844feb

SHA512
9e81e37f20cf660d83f25c569c7b64e51b102ed391454727dafb46bc1324bcca0ea8345ca0525a4e2c4c2cf37190c0df021c858c151f52958e44210486cc12cc

Download Submit