21f2a5be861a10d783ae780f059bb9d80765491377856aa8d29750d980ba15c9

Analysis

max time kernel
133s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 22:41

Target

2024-01-18_4370c8a2618c42dd4c06e159ba4bbbe1_mafia.exe
Size

384KB
MD5

4370c8a2618c42dd4c06e159ba4bbbe1
SHA1

4f17d47b41b06bc2a42661a4ae851bee256dbff8
SHA256

21f2a5be861a10d783ae780f059bb9d80765491377856aa8d29750d980ba15c9
SHA512

f2d0afd2194efe0fb6b6e09c3a05b6648a6be96befd89ae490880824a29b73c9663f37311b7a74a2b344065e1e63c2fddb2c401e3d1aa64c8597fd125f0c8d11
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hHS+e3/uOEqXZ+8A6T3HzE7SiD14MtdZ:Zm48gODxbzE5dEqXZ+U3TcZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1028	4779.tmp

Executes dropped EXE 1 IoCs

pid	Process
1028	4779.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 1028	4276	2024-01-18_4370c8a2618c42dd4c06e159ba4bbbe1_mafia.exe	18
PID 4276 wrote to memory of 1028	4276	2024-01-18_4370c8a2618c42dd4c06e159ba4bbbe1_mafia.exe	18
PID 4276 wrote to memory of 1028	4276	2024-01-18_4370c8a2618c42dd4c06e159ba4bbbe1_mafia.exe	18

C:\Users\Admin\AppData\Local\Temp\2024-01-18_4370c8a2618c42dd4c06e159ba4bbbe1_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_4370c8a2618c42dd4c06e159ba4bbbe1_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Local\Temp\4779.tmp
  "C:\Users\Admin\AppData\Local\Temp\4779.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-18_4370c8a2618c42dd4c06e159ba4bbbe1_mafia.exe EF7DD607BA7D6467C7B9CDFE859531FD316CD1A9E2AB1EEC53A720F30E74465628313AB7C74101EE010D8E62B271104E8D456E6EEBCAF83852F7BA7FEF99BA9A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1028

C:\Users\Admin\AppData\Local\Temp\4779.tmp

Filesize
111KB

MD5
12fad1f5a387e5214f2133e5005553c4

SHA1
49160a5a84fb6fa9e69abc632ff8d1af508f33a9

SHA256
3081e928cd6bc272c37e6c975992b9d1068733afa819dd5ad4c0d66c8cd1e88c

SHA512
369cef87de05af5b5f11955d6c455b42a01db308938a1cb8898e1a5b91a29b60be2fd57b35d300f82ede17050f2dfa970a8cd861806d1ed59ed9de6f03cbd931

Download Submit
C:\Users\Admin\AppData\Local\Temp\4779.tmp

Filesize
56KB

MD5
5acc2123d0cfb4ed51e64c713a4469b6

SHA1
938846fd065d30fe66b434b9b31521c721cf1fe7

SHA256
e9f06aec1f594aa2e18fc0045f767cb430cd9a61a7e226800c9e9c40cf39bb22

SHA512
87bcf47f0719baaabf11c662238e9d8fe9c0f2d73244e63324756e7fb23c906d91cd14c22f9e66c2446ff7a25355cab38069b5492aff48df1042b2944cc2b916

Download Submit