Overview

overview

7

Static

static

3

2024-01-18...ia.exe

windows7-x64

7

2024-01-18...ia.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    18-01-2024 23:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-01-18_90938dc98f206c491a2d10ef769d3ed3_mafia.exe

  • Size

    412KB

  • MD5

    90938dc98f206c491a2d10ef769d3ed3

  • SHA1

    6f65cf9a3e8cea487294423fa161631c4ca6cca0

  • SHA256

    3f7bf6c0ad5dd212b804b05dd6da31f67e38b37965cf61aeb9bdccb012737faa

  • SHA512

    367172b9e77b4463dbffcb86feb24775bf0506e65ae3ad26e9f8a71fc5465de9684bf62f3aecedbdeb390ce363d2964f5cbdae0a2664e0fc7c1045c77cb15452

  • SSDEEP

    6144:UooTAQjKG3wDGAeIc9kphIoDZnqn6wa3bakX8SV47lCPf20tIlJLgE4+UMgP:U6PCrIc9kph50EeEXCCPfm54+6

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-18_90938dc98f206c491a2d10ef769d3ed3_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-18_90938dc98f206c491a2d10ef769d3ed3_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Users\Admin\AppData\Local\Temp\1813.tmp
      "C:\Users\Admin\AppData\Local\Temp\1813.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-18_90938dc98f206c491a2d10ef769d3ed3_mafia.exe 33546DD499CD1FA7621BFCA6D951FEE11028A6A67DE2224276EE5350761B6C1922D667FC29FE45F97E4981201D12D19A94B7F627D5ABBEF8D7F05279D3B3C5B2
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1813.tmp
    Filesize

    21KB

    MD5

    246d3cd4d6d5a637b68e5ff41407ed69

    SHA1

    79fbf5f6ca7e624d77cc1230346675d88c605900

    SHA256

    93aca97684f63f3180b484bda5e593865df0d26aeb717ea3bd0571061cbe45c2

    SHA512

    886eb9e75c379d706dbadbba0ae975dc72b7bf93c297da2808154057046b6b6a1a0e5d9c999531001e7aafe63d2d4c30fdbabbcf5775f8d9e4c21daa552b4626

    Download Submit

  • \Users\Admin\AppData\Local\Temp\1813.tmp
    Filesize

    39KB

    MD5

    7ec0801146f9cb0ee97e23475df70966

    SHA1

    b24e2009f241cbf13d9cf770d0234de623717f9b

    SHA256

    1c9e00c0b7a1899b6685e9df43b0fce91a050932ef670ea47780ccd0748dbfc2

    SHA512

    25078bacc6b035102deed88a6c2a372ddc57804236bc852b2a54e7651bad42b0e27731234282bf740fa4741ab4712febd0c2cc17c9ba6e833af2e74926e5cb3a

    Download Submit